Repository navigation
Load .env from the repository root on every platform and make OAuth endpoints optional - #7
Merged
Merged
Conversation
…ndpoints optional loadEnvConfig() built the dotenv path with backslashes (__DIR__ . '\..\..\'), which only resolves on Windows: on Linux run.php died with InvalidPathException before binding a socket. It also created the default .env in the working directory while reading it from the repository root, read DB_* keys that the shipped example comments out (undefined index warnings in filesystem mode), and called die(). The file is now resolved relative to the repository root (or a directory passed in), every returned key has a default, real environment variables keep precedence over the file, and the default-token guard throws. run.php required SS14 and Discord OAuth2 credentials even for a plain verifier: getenv() returns false, which is a TypeError under strict_types. The endpoints are now registered only when both halves are set. The OAuth2 CSRF state is generated with random_bytes instead of uniqid(), which is time-based and guessable. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016WTP2S4qKEFT8a6a6yFEL4
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016WTP2S4qKEFT8a6a6yFEL4
Member
Author
|
2026-11-06: head 4302e0b. Local: Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Val · project thread
Problem
loadEnvConfig()built the dotenv path as__DIR__ . '\..\..\'. That only resolves on Windows; on Linuxphp run.phpdied withInvalidPathException: Unable to read any of the environment file(s) at [.../src/VerifierServer\..\..\/.env]before binding a socket (reproduced). It also created the default.envin the working directory while reading it from the repository root, readDB_*keys the shipped example comments out (undefined index warnings), and useddie().run.phppassedgetenv('SS14_OAUTH2_CLIENT_ID')etc. straight intostringparameters. Unset variables givefalse, which is aTypeErrorunderstrict_types, so a plain verifier could not start without SS14 and Discord OAuth credentials.statewasuniqid(), which is time-based and guessable.Change
.envis resolved relative to the repository root (or a directory passed toloadEnvConfig()), every returned key has a default, real environment variables keep precedence over the file, and the default-token guard throws instead of callingdie().run.phpregisters the/ss14waand/dwaendpoints only when both credentials are set.example.envand README describe this and comment out the MySQL block by default.stateisbin2hex(random_bytes(16)).Not changed here, but worth a follow-up: the OAuth2 sessions are keyed by client IP, so users behind one NAT share a session and
?userleaks the previous visitor's profile; and the token exchange uses blocking cURL inside the event loop. If the Discord login work in Civ13 reuses/dwa, it should move to cookie-based sessions first.Compatibility with Civilizationbot
The bot constructs
Server/PersistentStatedirectly from its owngetenv()values and never callsloadEnvConfig()in filesystem mode, so it is unaffected. Its integration call pattern was replayed against this branch and passed.Verification
New
tests/isolated/EnvConfigTest.php. Also confirmedloadEnvConfig()now runs from a foreign working directory on Linux.Generated by Claude Code