mirror of https://github.com/FoggedLens/deflock.git synced 2026-07-14 07:47:21 +02:00

Files

T

Chris Bowles 34e2cbdc2d remove username as public input from /sponsors/github

Extends the previous commit's fix. The only caller (Donate.vue via
apiService.getSponsors()) never sends a username and always relied on the
server-side default, so the parameter had no legitimate use even after
being parameterized — it just let anyone use deflock's server as an
unauthenticated relay onto GitHub's GraphQL API under the server's own
token. Drop it entirely: the route no longer accepts a username
querystring param, and GithubClient.getSponsors() takes no argument,
hardcoding the maintainer's login via MAINTAINER_USERNAME. Keeps the
$username GraphQL-variable parameterization technique so reintroducing a
variable input later can't reintroduce the injection.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-08 02:57:51 -04:00

582 B

Raw Blame History

DeFlock API

A Fastify-based API service for DeFlock handling non-OSM related backend logic.

Endpoints

/geocode?query=... — Geocode a location
/sponsors/github — Get GitHub sponsors
/healthcheck — Health check

Development

Prerequisites

Bun installed

Install dependencies

bun install

Run locally

bun dev

Deployment

Deployed via GitHub Actions on push to master.

Environment Variables

Create a .env file in this directory with:

GITHUB_TOKEN — Required for GitHub Sponsors endpoint

582 B Raw Blame History