kcar 67e47fc47f feat(tlsync): fetch short-lived token from API before multiplayer connect ...

- Remove VITE_TLSYNC_SECRET from browser env (no longer exposed to bundle)
- Add useTlsyncToken hook that fetches /api/tlsync/token with Supabase auth
- Extract TldrawCanvas sub-component: only renders after token is ready
- Pass API-issued short-lived token to createSyncConnectionOptions
- Add vite.config.ts blocklist to prevent secret leak (defense-in-depth)
- Remove VITE_TLSYNC_SECRET from .env.example (server-side only now)

Related: t_a69128a1 (API token endpoint), t_41a844a7 (this task)

2026-05-28 18:00:43 +01:00

..

CCDocumentIntelligence

feat(phase-b): school/timetable wizards, graph nav panel, UI updates

2026-05-26 01:25:29 +01:00

CCExamMarker

Initial commit

2025-07-11 13:21:49 +00:00

devPage.tsx

Initial commit

2025-07-11 13:21:49 +00:00

devPlayerPage.tsx

Initial commit

2025-07-11 13:21:49 +00:00

multiplayerUser.tsx

feat(tlsync): fetch short-lived token from API before multiplayer connect

2026-05-28 18:00:43 +01:00

ShareHandler.tsx

Initial commit

2025-07-11 13:21:49 +00:00

singlePlayerPage.tsx

feat(phase-b): Supabase navigation store, snapshot service, auth wiring

2026-05-26 01:25:15 +01:00

TLDrawCanvas.tsx

Initial commit

2025-07-11 13:21:49 +00:00