From c475d3bbf9152cc42867c5f8845cfd91ffc200a4 Mon Sep 17 00:00:00 2001 From: Fiona Date: Mon, 6 Jul 2026 19:05:30 -0700 Subject: [PATCH 1/2] fix(core): remove hardcoded internal staging IP from intake sites The staging/fed-staging intake endpoints were hardcoded to an internal IP (http://10.99.1.110:11300) directly in `intakeSites.ts`. Since these constants are publicly exported, the internal IP + plaintext http endpoint leaked into every published `@flashcatcloud/browser-*` artifact. Move the staging endpoints to the existing build-time injection mechanism (`__BUILD_ENV__*` + replace-build-env / webpack DefinePlugin), the same convention already used for SDK_VERSION. Values are read from the INTAKE_SITE_STAGING / INTAKE_SITE_FED_STAGING env vars at build time and default to an empty string, so release artifacts never contain an internal host. Staging remains configurable by setting the env var at build time. Verified: `BUILD_MODE=release` build of @flashcatcloud/browser-core emits `INTAKE_SITE_STAGING = ""` and `grep -r 10.99` over cjs/ and esm/ is clean. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../core/src/domain/configuration/intakeSites.ts | 14 ++++++++++---- scripts/lib/buildEnv.js | 5 +++++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/packages/core/src/domain/configuration/intakeSites.ts b/packages/core/src/domain/configuration/intakeSites.ts index 3f14170dbe..e0951ff17f 100644 --- a/packages/core/src/domain/configuration/intakeSites.ts +++ b/packages/core/src/domain/configuration/intakeSites.ts @@ -1,8 +1,14 @@ -// fixme site list修改 -export type Site = 'browser.flashcat.cloud' | 'http://10.99.1.110:11300' // fixme later +// Staging intake endpoints are injected at build time (see scripts/lib/buildEnv.js) +// and default to an empty string in public release builds. This keeps internal +// staging hosts out of the published `@flashcatcloud/browser-*` artifacts. +// Replaced at build time by replace-build-env / webpack DefinePlugin. +declare const __BUILD_ENV__INTAKE_SITE_STAGING__: string +declare const __BUILD_ENV__INTAKE_SITE_FED_STAGING__: string -export const INTAKE_SITE_STAGING: Site = 'http://10.99.1.110:11300' as Site -export const INTAKE_SITE_FED_STAGING: Site = 'http://10.99.1.110:11300' as Site +export type Site = string + +export const INTAKE_SITE_STAGING: Site = __BUILD_ENV__INTAKE_SITE_STAGING__ +export const INTAKE_SITE_FED_STAGING: Site = __BUILD_ENV__INTAKE_SITE_FED_STAGING__ export const INTAKE_SITE_US1: Site = 'browser.flashcat.cloud' export const INTAKE_SITE_EU1: Site = 'browser.flashcat.cloud' export const INTAKE_SITE_US1_FED: Site = 'browser.flashcat.cloud' diff --git a/scripts/lib/buildEnv.js b/scripts/lib/buildEnv.js index 99899abc79..818f796364 100644 --- a/scripts/lib/buildEnv.js +++ b/scripts/lib/buildEnv.js @@ -41,6 +41,11 @@ const buildEnvFactories = { } }, SDK_SETUP: () => getSdkSetup(), + // Staging intake endpoints. Injected from the environment at build time so the + // internal staging host is never hardcoded in source or shipped in public + // release artifacts. Empty by default (e.g. release builds). + INTAKE_SITE_STAGING: () => process.env.INTAKE_SITE_STAGING || '', + INTAKE_SITE_FED_STAGING: () => process.env.INTAKE_SITE_FED_STAGING || process.env.INTAKE_SITE_STAGING || '', WORKER_STRING: () => { const workerPath = path.join(__dirname, '../../packages/worker') // Make sure the worker is built From 5977f5e9bce0bd5466fec878cbdf5afc792dbe33 Mon Sep 17 00:00:00 2001 From: Fiona Date: Tue, 7 Jul 2026 05:14:08 -0700 Subject: [PATCH 2/2] fix(core): hardcode public staging intake host jira.flashcat.cloud Replace the build-time env injection with a hardcoded public https host, matching the native SDKs (Android FlashcatSite.STAGING / iOS FlashcatSite.staging both use jira.flashcat.cloud). This keeps the original audit finding resolved (no internal 10.99.x IP, no cleartext http/port) while making staging work out of the box across all builds with zero CI wiring, and keeps the three client SDKs consistent. Co-Authored-By: Claude Opus 4.8 --- .../core/src/domain/configuration/intakeSites.ts | 14 +++++--------- scripts/lib/buildEnv.js | 5 ----- 2 files changed, 5 insertions(+), 14 deletions(-) diff --git a/packages/core/src/domain/configuration/intakeSites.ts b/packages/core/src/domain/configuration/intakeSites.ts index e0951ff17f..13619e4663 100644 --- a/packages/core/src/domain/configuration/intakeSites.ts +++ b/packages/core/src/domain/configuration/intakeSites.ts @@ -1,14 +1,10 @@ -// Staging intake endpoints are injected at build time (see scripts/lib/buildEnv.js) -// and default to an empty string in public release builds. This keeps internal -// staging hosts out of the published `@flashcatcloud/browser-*` artifacts. -// Replaced at build time by replace-build-env / webpack DefinePlugin. -declare const __BUILD_ENV__INTAKE_SITE_STAGING__: string -declare const __BUILD_ENV__INTAKE_SITE_FED_STAGING__: string - export type Site = string -export const INTAKE_SITE_STAGING: Site = __BUILD_ENV__INTAKE_SITE_STAGING__ -export const INTAKE_SITE_FED_STAGING: Site = __BUILD_ENV__INTAKE_SITE_FED_STAGING__ +// Internal staging intake host. Public https domain (no internal IP / cleartext +// endpoint), consistent with the native SDKs: Android FlashcatSite.STAGING and +// iOS FlashcatSite.staging both map staging to `jira.flashcat.cloud`. +export const INTAKE_SITE_STAGING: Site = 'jira.flashcat.cloud' +export const INTAKE_SITE_FED_STAGING: Site = 'jira.flashcat.cloud' export const INTAKE_SITE_US1: Site = 'browser.flashcat.cloud' export const INTAKE_SITE_EU1: Site = 'browser.flashcat.cloud' export const INTAKE_SITE_US1_FED: Site = 'browser.flashcat.cloud' diff --git a/scripts/lib/buildEnv.js b/scripts/lib/buildEnv.js index 818f796364..99899abc79 100644 --- a/scripts/lib/buildEnv.js +++ b/scripts/lib/buildEnv.js @@ -41,11 +41,6 @@ const buildEnvFactories = { } }, SDK_SETUP: () => getSdkSetup(), - // Staging intake endpoints. Injected from the environment at build time so the - // internal staging host is never hardcoded in source or shipped in public - // release artifacts. Empty by default (e.g. release builds). - INTAKE_SITE_STAGING: () => process.env.INTAKE_SITE_STAGING || '', - INTAKE_SITE_FED_STAGING: () => process.env.INTAKE_SITE_FED_STAGING || process.env.INTAKE_SITE_STAGING || '', WORKER_STRING: () => { const workerPath = path.join(__dirname, '../../packages/worker') // Make sure the worker is built