mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 17:29:45 +00:00
7d466ca865
Pre-fix: `getBaseUrl()` in /api/account/invitations defaulted to `https://wacrm.tech` whenever `NEXT_PUBLIC_SITE_URL` was unset. wacrm.tech is the docs/marketing site (separate ArnasDon/wacrm-site repo); it has no `/join/[token]` route. Any fork that didn't set the env var got invite links pointing into the marketing site, which 404'd on click. Reported by @ArnasDon while testing the flow on production. Post-fix: `getBaseUrl(request)` resolves in this order: 1. `NEXT_PUBLIC_SITE_URL` — explicit operator config, still wins. 2. `X-Forwarded-Host` (+ `X-Forwarded-Proto`) — set by every reverse proxy in front of the app (Hostinger Managed Node.js, Vercel, Cloudflare). This is what makes invite links Just Work in production without any env-var fiddling. 3. `Host` header + the request's protocol — bare deployments without a proxy in front. 4. `https://wacrm.tech` last-resort fallback with a console.warn so operators spot the misconfig in logs. Effectively unreachable from a real browser; only triggers if there's no Host header at all. Also tightened `.env.local.example` so the variable's purpose matches the new behavior: it's now only needed when the request- derived origin would be wrong (cron jobs, background workers). Day-to-day forks don't have to remember it. Verification - `npm run lint` → 0 errors (same 19 pre-existing warnings) - `npm run typecheck` → clean (after `rm -rf .next` to clear stale [locale]/* type stubs from the i18n revert that landed on main) - `npm test` → 366/366 pass - `npm run build` → succeeds Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
61 lines
2.9 KiB
Plaintext
61 lines
2.9 KiB
Plaintext
# ============================================================
|
|
# REQUIRED — the app won't start without these.
|
|
# ============================================================
|
|
|
|
# Supabase (Project Settings → API)
|
|
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
|
|
|
# Supabase service-role key. Bypasses RLS; used only by server-side
|
|
# routes (the webhook and automation engine). Keep this secret —
|
|
# never paste it into client code.
|
|
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
|
|
|
# WhatsApp token encryption (64 hex chars = 32 bytes, AES-256-GCM).
|
|
# Generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# Rotating this value orphans every token encrypted under the previous
|
|
# key — users have to re-save their WhatsApp settings to reconnect.
|
|
ENCRYPTION_KEY=your-64-char-hex-key-here
|
|
|
|
# Meta App Secret (Meta for Developers → App Settings → Basic).
|
|
# Verifies the HMAC-SHA256 signature on every inbound webhook POST.
|
|
# Required — without it the webhook rejects every request.
|
|
META_APP_SECRET=your-meta-app-secret
|
|
|
|
# ============================================================
|
|
# RECOMMENDED — safe defaults exist but you'll want to set these.
|
|
# ============================================================
|
|
|
|
# Canonical public URL of this deployment (scheme + host, no trailing
|
|
# slash). Used for the sitemap and OG images. Routes that need a
|
|
# self-referential URL (invite links from /api/account/invitations,
|
|
# any future email-bound link) derive the origin from the request
|
|
# itself, so this variable is *only* needed when the request-derived
|
|
# origin would be wrong — e.g. when generating links from a cron job
|
|
# or a background worker that has no incoming request.
|
|
NEXT_PUBLIC_SITE_URL=https://crm.example.com
|
|
|
|
# ============================================================
|
|
# OPTIONAL — only needed if you use the feature.
|
|
# ============================================================
|
|
|
|
# Shared secret protecting GET /api/automations/cron. Required if you
|
|
# use Wait steps in automations (a scheduled pinger drains pending
|
|
# executions). Generate any long random string:
|
|
# openssl rand -hex 32
|
|
# See docs/automations-and-cron.md.
|
|
# AUTOMATION_CRON_SECRET=generate-a-long-random-string
|
|
|
|
# Meta App ID (Meta for Developers → App Settings → Basic). Required
|
|
# only for the (planned) Resumable Upload flow that lets users attach
|
|
# local media files as template header samples. Submitting templates
|
|
# with a public sample URL works without it. Pair with META_APP_SECRET.
|
|
# META_APP_ID=your-meta-app-id
|
|
|
|
# When "true", POST /api/whatsapp/templates/submit skips the Meta call
|
|
# and stores the row with a synthetic `dry-run-<uuid>` meta_template_id.
|
|
# Set this in CI and local development so you can exercise the full
|
|
# template UI without a real WABA. Leave unset (or "false") in prod.
|
|
# WHATSAPP_TEMPLATES_DRY_RUN=true
|