From b3fa42b14a8add4ec22f946c3e64a61bf2f0a311 Mon Sep 17 00:00:00 2001 From: neodk2004 Date: Tue, 21 Jul 2026 21:24:05 +0200 Subject: [PATCH] docs(env): document Mux vars in .env.example, fix stale R2 references in AvatarUpload .env.example was missing MUX_TOKEN_ID/MUX_TOKEN_SECRET/MUX_WEBHOOK_SECRET/ NEXT_PUBLIC_APP_URL even though they're required fields per docker/.env. AvatarUpload's docblock still described the pre-migration R2 upload path; storage has been Supabase-only since the R2 removal. Local .env/.env.local consolidation (not tracked by git) done alongside this: merged the split DB/Supabase/Clerk/Mux config into .env.local and removed the dead, never-filled R2 placeholder vars from .env. --- .env.example | 10 ++++++++++ src/components/pet/AvatarUpload.tsx | 6 +++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.env.example b/.env.example index 249cfb4..213e348 100644 --- a/.env.example +++ b/.env.example @@ -25,6 +25,16 @@ SUPABASE_SERVICE_ROLE_KEY="eyJxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY="pk_test_xxxxxxxxxxxxxxxxxxxx" CLERK_SECRET_KEY="sk_test_xxxxxxxxxxxxxxxxxxxx" +# ── Mux (Video) ────────────────────────────────────────────── +# Mux Dashboard → Settings → Access Tokens → Create Token (Mux Video) +MUX_TOKEN_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" +MUX_TOKEN_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +# Mux Dashboard → Webhooks → Add endpoint → copy Signing Secret +# Endpoint must point at https:///api/webhooks/mux +MUX_WEBHOOK_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +# Your public app URL (used as CORS origin for Mux direct uploads) +NEXT_PUBLIC_APP_URL="http://localhost:3000" + # ── Admin Panel ─────────────────────────────────────────────── # NEVER use NEXT_PUBLIC_ prefix — these MUST stay server-only! # ADMIN_SECRET: random UUID path segment (/p/[secret]/) — generate with: diff --git a/src/components/pet/AvatarUpload.tsx b/src/components/pet/AvatarUpload.tsx index 81222df..e275faf 100644 --- a/src/components/pet/AvatarUpload.tsx +++ b/src/components/pet/AvatarUpload.tsx @@ -18,14 +18,14 @@ import { uploadFileWithProgress } from "@/lib/upload-xhr"; * Upload flow (Architecture constraint — image bytes never pass through Next.js API): * 1. File validated client-side (size <= 10MB, type jpeg/png/webp) * 2. media.getPresignedUrl tRPC mutation → { presignedUrl, key } - * 3. XMLHttpRequest PUT directly to R2 presigned URL (tracks upload progress) + * 3. XMLHttpRequest PUT directly to the Supabase Storage presigned URL (tracks upload progress) * 4. media.confirmUpload tRPC mutation → writes avatarKey to Pet DB row * 5. CDN URL constructed and displayed; onUploadComplete callback fired * * Security: - * - No R2 credentials in this client component (T-4-03) + * - No Supabase Storage credentials in this client component (T-4-03) * - contentType sent to presignedUrl MUST match Content-Type in PUT (Pitfall 4 prevention) - * - NEXT_PUBLIC_R2_PUBLIC_URL is the CDN domain only — not credentials + * - NEXT_PUBLIC_SUPABASE_URL is the CDN domain only — not credentials * * Props: * - petId: string | undefined — undefined in create mode (upload disabled until pet saved)