Merge pull request #49 from mattyatea/cursor/fix-github-actions-client-id-issue-3768

Fix github actions client id issue

Author: mattyatea

.github/workflows/ci-cd.yml

@@ -36,6 +36,19 @@ jobs:
           NODE_ENV: test
           JWT_SECRET: test-jwt-secret-for-ci
           REFRESH_TOKEN_SECRET: test-refresh-token-secret-for-ci
+          GOOGLE_CLIENT_ID: test-google-client-id
+          GOOGLE_CLIENT_SECRET: test-google-client-secret
+          GH_OAUTH_CLIENT_ID: test-gh-oauth-client-id
+          GH_OAUTH_CLIENT_SECRET: test-gh-oauth-client-secret
+          JWT_ALGORITHM: HS256
+          JWT_EXPIRES_IN: 7d
+          RATE_LIMIT_ANONYMOUS: "100"
+          RATE_LIMIT_AUTHENTICATED: "1000"
+          RATE_LIMIT_API_KEY: "5000"
+          EMAIL_FROM: noreply+zxcv@prism-project.net
+          FRONTEND_URL: http://localhost:3000/
+          APP_URL: http://localhost:3000
+          ENVIRONMENT: test
 
       - name: Security audit
         run: |

server/tsconfig.json

@@ -35,6 +35,7 @@
     ".nuxt/imports.d.ts",
     ".nuxt/components.d.ts",
     "worker-configuration.d.ts",
+    "worker-configuration.override.d.ts",
     "nuxt.d.ts"
   ],
   "exclude": [

server/worker-configuration.d.ts

@@ -3,11 +3,6 @@
 // Runtime types generated with workerd@1.20250712.0 2025-07-15 no_nodejs_compat_v2,nodejs_compat
 declare namespace Cloudflare {
 	interface Env {
-		JWT_SECRET: "test-jwt-secret";
-		GOOGLE_CLIENT_ID: "test-google-client-id";
-		GOOGLE_CLIENT_SECRET: "test-google-client-secret";
-		GH_OAUTH_CLIENT_ID: "test-gh-oauth-client-id";
-		GH_OAUTH_CLIENT_SECRET: "test-gh-oauth";
 		JWT_ALGORITHM: "HS256";
 		JWT_EXPIRES_IN: "7d";
 		RATE_LIMIT_ANONYMOUS: "100";

server/worker-configuration.override.d.ts

@@ -0,0 +1,12 @@
+/* eslint-disable */
+// Override auto-generated types for secrets
+// Secrets are provided at runtime via wrangler secret, not from wrangler.toml
+declare namespace Cloudflare {
+	interface Env {
+		JWT_SECRET: string;
+		GOOGLE_CLIENT_ID: string;
+		GOOGLE_CLIENT_SECRET: string;
+		GH_OAUTH_CLIENT_ID: string;
+		GH_OAUTH_CLIENT_SECRET: string;
+	}
+}

server/wrangler.toml

@@ -21,11 +21,8 @@ bucket_name = "zxcv"
 name = "EMAIL_SENDER"
 
 [vars]
-JWT_SECRET = "test-jwt-secret"
-GOOGLE_CLIENT_ID = "test-google-client-id"
-GOOGLE_CLIENT_SECRET = "test-google-client-secret"
-GH_OAUTH_CLIENT_ID = "test-gh-oauth-client-id"
-GH_OAUTH_CLIENT_SECRET = "test-gh-oauth"
+# Non-secret configuration for production
+# Secrets (JWT_SECRET, GOOGLE_CLIENT_ID, etc.) are set via wrangler secret during deployment
 JWT_ALGORITHM = "HS256"
 JWT_EXPIRES_IN = "7d"
 RATE_LIMIT_ANONYMOUS = "100"
@@ -58,6 +55,8 @@ bucket_name = "zxcv-staging"
 name = "EMAIL_SENDER"
 
 [env.staging.vars]
+# Non-secret configuration for staging
+# Secrets (JWT_SECRET, GOOGLE_CLIENT_ID, etc.) are set via wrangler secret during deployment
 JWT_ALGORITHM = "HS256"
 JWT_EXPIRES_IN = "7d"
 RATE_LIMIT_ANONYMOUS = "100"
@@ -71,4 +70,4 @@ ENVIRONMENT = "staging"
 # Workers Assets configuration for staging
 [env.staging.assets]
 binding = "ASSETS"
-directory = ".output/public"
+directory = ".output/public"