Connect to production by default?

[binary-koan]

Would be awesome if you could just do the README setup for this project and have it running linked to production immediately. Need to think through the security implications, but ideally the mobile API should be public anyway.

[binary-koan]

Pretty good summary of the security issues with this. We can mitigate these once we've replaced the current app with this

  High Risk

  Endpoints that check ONLY mobile_token (no per-user OAuth):
  - url_redirects/get_url_redirect_attributes/:id — exposes purchase/download metadata. If :id is sequential or guessable, this enables enumeration of purchases.
  - subscriptions/subscription_attributes/:id — same risk
  - preorders/preorder_attributes/:id — same risk
  - installments/:id — same risk
  - url_redirects/fetch_placeholder_products — public product data, likely lower risk

  These have zero authentication protection if mobile_token is removed. The content endpoints (stream/, download/, hls_playlist/) also fall here, though they're further protected by a
  per-purchase :token in the URL path.

  Web controller integration (url_redirects_controller.rb:351-357): The main web controller has a special code path that checks params[:mobile_token] ==
  Api::Mobile::BaseController::MOBILE_TOKEN to sign in users via OAuth for content access. Removing mobile_token would break or need to rework this integration.

  Medium Risk

  Session creation (POST /api/mobile/sessions): Currently gated by mobile_token + mobile_api OAuth scope. Removing the shared secret makes the login endpoint callable by anyone, relying
  entirely on rate limiting and Doorkeeper for brute-force protection.

  Device registration (POST /api/mobile/devices): Anyone could register arbitrary push notification device tokens, potentially enabling spam or push notification abuse.