designslife/WebForm-mw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docs: document STAFF_REPORT_KEY env var

Browse Source
This commit is contained in:
Joel Brock
2026-06-05 16:38:38 -07:00
parent 36821f42a8
commit e76ed39091
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AMPLIFY_DEPLOY.md
+7
View File
@@ -56,6 +56,13 @@ Add each variable to the page indicated below:
| `CIVI_HTTP_AUTH_PASS` | **Secrets** | Only if above set | | `CIVI_HTTP_AUTH_PASS` | **Secrets** | Only if above set |
| `HEALTH_TOKEN` | **Secrets** | Optional; gates `/api/health` in production | | `HEALTH_TOKEN` | **Secrets** | Optional; gates `/api/health` in production |
| `PREVIEW_ADMIN_TOKEN` | **Secrets** | Optional; gates `/api/preview-link` | | `PREVIEW_ADMIN_TOKEN` | **Secrets** | Optional; gates `/api/preview-link` |
| `STAFF_REPORT_KEY` | **Secrets** | Shared secret for `/staff/report` and `/api/staff/file` |
**`STAFF_REPORT_KEY`** — shared secret guarding the internal staff report
at `/staff/report` and the file proxy at `/api/staff/file`. Store in
Amplify SSM Parameter Store next to the `CIVI_*` secrets. Rotate by
changing the env value; all live links must be updated. Anyone with the
secret can view any organization's full activity history.
Rule of thumb: if leaking the value would let someone impersonate the app Rule of thumb: if leaking the value would let someone impersonate the app
to CiviCRM, or bypass a gate, it goes in **Secrets**. Hostnames and to CiviCRM, or bypass a gate, it goes in **Secrets**. Hostnames and
DEPLOYMENT.md
+1
View File
@@ -29,6 +29,7 @@ Verify all of the above against your live CiviCRM by hitting `/api/health` (in d
| `CIVI_HTTP_AUTH_PASS` | only if CIVI_HTTP_AUTH_USER is set | HTTP Basic Auth password. | | `CIVI_HTTP_AUTH_PASS` | only if CIVI_HTTP_AUTH_USER is set | HTTP Basic Auth password. |
| `HEALTH_TOKEN` | recommended | Long random string (e.g. `openssl rand -hex 32`). Required to access `/api/health` in production. If unset, that route returns 404. | | `HEALTH_TOKEN` | recommended | Long random string (e.g. `openssl rand -hex 32`). Required to access `/api/health` in production. If unset, that route returns 404. |
| `PUBLIC_ORIGIN` | optional | e.g. `https://survey.fci.coop` — used in absolute self-links if needed later. | | `PUBLIC_ORIGIN` | optional | e.g. `https://survey.fci.coop` — used in absolute self-links if needed later. |
| `STAFF_REPORT_KEY` | recommended | Shared secret guarding the internal staff report at `/staff/report` and the file proxy at `/api/staff/file`. Store alongside the `CIVI_*` secrets. Rotate by changing the env value; all live links must be updated. Anyone with the secret can view any organization's full activity history. |
3. **Trigger the first deploy.** Render will run `npm ci && npm run build` then `npm run start`. The platform health check hits `/healthz` (lightweight, no Civi dependency). 3. **Trigger the first deploy.** Render will run `npm ci && npm run build` then `npm run start`. The platform health check hits `/healthz` (lightweight, no Civi dependency).