ClassroomCopilot/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove TLSync shared secret from frontend bundle

Browse Source 
- Remove VITE_TLSYNC_SECRET from syncService.ts; token is now
  fetched at runtime via fetchTlsyncToken() from the API backend
- Add token?: string to SyncConnectionOptions interface
- Update multiplayerUser.tsx to fetch TLSync token from API on mount
  and pass it through createSyncConnectionOptions
- Remove VITE_TLSYNC_SECRET from .env.example

The API must implement GET /tlsync/token (authenticated via Supabase
Bearer token) to complete the fix.
This commit is contained in:
kcar
2026-05-28 14:00:52 +01:00
parent 0db53bfd9c
commit 217f393de9
3 changed files with 58 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
-1
View File
@@ -27,7 +27,6 @@ VITE_SUPABASE_ANON_KEY=your-supabase-anon-key
# TLSync (TLDraw Sync) Configuration
# =============================================================================
VITE_TLSYNC_URL=https://app.classroomcopilot.ai/tldraw
VITE_TLSYNC_SECRET=your-tlsync-secret
# =============================================================================
# WhisperLive (Transcription) Configuration