golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(todos): purge token rename follow-up for grzybyfunkcjonalne

Browse Source
This commit is contained in:
Jakub Zych
2026-10-20 21:14:35 +02:00
parent fd20fc97e4
commit 95ae878bd3
1 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
.planning/todos/pending/2026-10-20-rename-site-cache-purge-env-in-consumers.md Normal file
View File

@@ -0,0 +1,41 @@
---
created: 2026-10-20T21:30:00.000Z
title: Move grzybyfunkcjonalne to NUXT_CACHE_PURGE_TOKEN and the new layers before the NUXT_SITE_CACHE_* names are dropped
area: consumers
severity: minor
g15office: TBD
files:
- ../sm-grzybyfunkcjonalne-app/deploy/nuxt.env.example
- ../sm-grzybyfunkcjonalne-app/deploy/env.example
- ../sm-grzybyfunkcjonalne-app/DEPLOY.md
- ../sm-grzybyfunkcjonalne-app/README.md
- ../sm-grzybyfunkcjonalne-app/vue-grzybyfunkcjonalne-app/package.json
- ../sm-journal-plugin/README.md
- ../sm-menu-plugin/README.md
- ../sm-faq-plugin/README.md
- ../vue-journal-layer
- ../vue-menu-layer
- ../vue-faq-layer
---
## Problem
Quick task 261020-sdt found that nuxt-site-config (pulled in by `@nuxtjs/seo` in vue-journal-layer) copies every `NUXT_SITE_*` environment variable into the public site config, so the documented purge token `NUXT_SITE_CACHE_PURGE_TOKEN` was published in every page's payload as `cachePurgeToken` (and `NUXT_SITE_CACHE_ALLOW_PROXIED` as `cacheAllowProxied`). vue-journal-layer v0.6.0, vue-menu-layer v0.4.0 and vue-faq-layer v0.4.0 (tagged 2026-10-20) read `NUXT_CACHE_PURGE_TOKEN` / `NUXT_CACHE_PURGE_ALLOW_PROXIED`, keep the old names working for one release with a deprecation warning, and strip the two keys from the site config. The demo and summercms.io moved in the same task.
grzybyfunkcjonalne has not moved:
- `vue-grzybyfunkcjonalne-app` pins vue-journal-layer `#v0.4.0` and vue-menu-layer / vue-faq-layer `#v0.2.0`: no stripping, so a set `NUXT_SITE_CACHE_PURGE_TOKEN` is published on every page.
- `deploy/nuxt.env.example` line 22 declares `NUXT_SITE_CACHE_PURGE_TOKEN=`; `deploy/env.example` line 22, `DEPLOY.md` lines 86 and 211 and `README.md` line 127 name it.
- Probe on 2026-10-20 (counts only): `https://uat.grzybyfunkcjonalne.pl/` answers 401 to anonymous requests (Basic auth), so the payload could not be checked from outside; `https://grzybyfunkcjonalne.pl/` serves the PHP site (no Nuxt payload, 0 `cachePurgeToken`). Basic auth limits the exposure to people holding the UAT credentials, but the token is still in every UAT page for them.
- The plugin READMEs still name the old variable: sm-journal-plugin "Receiver" (line ~292), sm-menu-plugin (line ~146), sm-faq-plugin (line ~73).
## Solution
Each step needs the user's go-ahead for anything pushed or deployed (grzybyfunkcjonalne is production).
1. Check the UAT payload with the UAT credentials: `grep -o cachePurgeToken | wc -l` on `/` (counts only, never the value), and on the server count the key lines in the Nuxt env file (`grep -c '^NUXT_SITE_CACHE_PURGE_TOKEN='`). If the old name is set, the token counts as leaked to every UAT visitor.
2. Move `vue-grzybyfunkcjonalne-app` to vue-journal-layer `#v0.6.0`, vue-menu-layer `#v0.4.0`, vue-faq-layer `#v0.4.0` (check the v0.3/v0.5 changes in between: the shared `/api/__site__/cache/purge` route, `allowProxied`), `pnpm install` touching only the layer entries, build and smoke.
3. Rename in `deploy/nuxt.env.example`, `deploy/env.example`, `DEPLOY.md` and `README.md`; add a check that refuses a `NUXT_SITE_*` key in the Nuxt env template, as sm-demo-app and sm-summercmsio-app do in `scripts/check-deploy.sh`.
4. On the server: rotate the token in both files with the recipe of `../sm-demo-app/DEPLOY.md`, "Rotating the site-cache purge token" (generated on the server, never printed, sha256 equality verdict, one restart), then verify the loopback purge (200 with the token, 401 without) and 0 `cachePurgeToken` on UAT pages.
5. Update the three plugin READMEs to `NUXT_CACHE_PURGE_TOKEN` (each plugin repo first, then the pointer bumps in the apps).
6. Only after every consumer has moved: drop the deprecated names in the next layer minors (vue-journal-layer 0.7.0, vue-menu-layer and vue-faq-layer 0.5.0) and revisit the deprecated-token assertions in the demo's and summercms.io's `scripts/smoke.sh`.