Repository navigation
Isolate Roteiva DEV/PROD accounts, configuration and deployment - #111
Merged
Merged
Conversation
EwertonMendes
changed the title
EwertonMendes
deployed
to
cloudflare-development
November 11, 2026 12:40 — with 
GitHub Actions
Active
GitHub Actions
Active
EwertonMendes
marked this pull request as ready for review
November 11, 2026 12:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Centralizes the environment contract across Vite, Firebase, Worker, media URLs and workflows. Production builds and API requests reject cross-environment resources. DEV migrated to its dedicated branded Cloudflare account with existing Firebase users/data, 25 D1 tables/99 rows, encryption keys and OAuth clients preserved. The legacy endpoint forwards to the new DEV API without a competing Cron or writable database.
Provisions isolated free PROD accounts/projects, empty schema, independent OAuth credentials and protected GitHub environments. Adds immutable database identity, account-scope token checks, conservative migration guards, atomic secret bootstrap with sanitized validation failures, and privacy/terms/support pages. Patches the Firebase transitive re2js vulnerability (GHSA-gg6h-894w-4m9c) to 2.8.7.
Validation: 215 API tests, 75 frontend tests, TypeScript, 34 Firestore A/B tests, builds dev/prod/demo/emulator, Worker dry-runs, full Chromium desktop/mobile regression (145 passed, 5 pre-existing skips). Final PR checks: API 43023152654, frontend 43023152747, rules 43023152671 and isolated E2E 43023152754 passed. Production dependency audits are clean. DEV deployment 43022319789 validated the new token, rejected access to PROD D1 and passed health/CORS/auth/migration checks. Real DEV Google reconnect/list and existing Dropbox grant/list/PDF passed. PROD backend credential can read/list PROD Firestore but receives 403 in DEV; PROD user collection is empty.
Owner authorized completion and delegated activation decisions on 11 November. First PROD deployment is still to run through the protected manual workflow. Google restricted-scope verification and Dropbox production review remain external requirements; no provider approval is claimed. Console branding/scopes could not be completed after browser control stopped responding. No paid plan/billing enabled; no DEV business data copied to PROD.