mirror of
https://github.com/FoggedLens/deflock.git
synced 2026-07-14 15:57:20 +02:00
Chris Bowles
34e2cbdc2d
Extends the previous commit's fix. The only caller (Donate.vue via apiService.getSponsors()) never sends a username and always relied on the server-side default, so the parameter had no legitimate use even after being parameterized — it just let anyone use deflock's server as an unauthenticated relay onto GitHub's GraphQL API under the server's own token. Drop it entirely: the route no longer accepts a username querystring param, and GithubClient.getSponsors() takes no argument, hardcoding the maintainer's login via MAINTAINER_USERNAME. Keeps the $username GraphQL-variable parameterization technique so reintroducing a variable input later can't reintroduce the injection. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
32 lines
582 B
Markdown
32 lines
582 B
Markdown
# DeFlock API
|
|
|
|
A Fastify-based API service for DeFlock handling non-OSM related backend logic.
|
|
|
|
## Endpoints
|
|
- `/geocode?query=...` — Geocode a location
|
|
- `/sponsors/github` — Get GitHub sponsors
|
|
- `/healthcheck` — Health check
|
|
|
|
## Development
|
|
|
|
### Prerequisites
|
|
- [Bun](https://bun.sh/) installed
|
|
|
|
### Install dependencies
|
|
```sh
|
|
bun install
|
|
```
|
|
|
|
### Run locally
|
|
```sh
|
|
bun dev
|
|
```
|
|
|
|
## Deployment
|
|
|
|
Deployed via GitHub Actions on push to `master`.
|
|
|
|
## Environment Variables
|
|
Create a `.env` file in this directory with:
|
|
- `GITHUB_TOKEN` — Required for GitHub Sponsors endpoint
|