Skip to content

Commit 2636f76

Browse files
Nitin-kumar-yadav1307Nitin-kumar-yadav1307
committed
fix: address security and compatibility findings
1. CI: add permissions: contents: read, persist-credentials: false, include workflow in paths, pin Python deps 2. DEVEX.md: use immutable release tag + checksum verification for quickstart scripts 3. main.py: use Optional[dict] instead of dict | None for Python 3.9 compat 4. Quickstart scripts: remove SECRET_KEY/PROJECT_ID from client scaffolds, keep only publishable credentials 5. Python quickstart: fix base_url -> base parameter for UrBackendClient
1 parent dec4338 commit 2636f76

5 files changed

Lines changed: 36 additions & 23 deletions

File tree

‎.github/workflows/examples.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,16 @@ on:
66
paths:
77
- 'examples/**'
88
- 'sdks/**'
9+
- '.github/workflows/examples.yml'
910
pull_request:
1011
branches: [ main ]
1112
paths:
1213
- 'examples/**'
1314
- 'sdks/**'
15+
- '.github/workflows/examples.yml'
16+
17+
permissions:
18+
contents: read
1419

1520
jobs:
1621
react-sdk-demo:
@@ -20,6 +25,8 @@ jobs:
2025
working-directory: examples/react-sdk-demo
2126
steps:
2227
- uses: actions/checkout@v4
28+
with:
29+
persist-credentials: false
2330
- uses: actions/setup-node@v4
2431
with:
2532
node-version: '20'
@@ -35,6 +42,8 @@ jobs:
3542
working-directory: examples/sdk-kanban/client
3643
steps:
3744
- uses: actions/checkout@v4
45+
with:
46+
persist-credentials: false
3847
- uses: actions/setup-node@v4
3948
with:
4049
node-version: '20'
@@ -50,6 +59,8 @@ jobs:
5059
working-directory: examples/social-demo/client
5160
steps:
5261
- uses: actions/checkout@v4
62+
with:
63+
persist-credentials: false
5364
- uses: actions/setup-node@v4
5465
with:
5566
node-version: '20'
@@ -65,10 +76,13 @@ jobs:
6576
working-directory: examples/python-sdk-demo
6677
steps:
6778
- uses: actions/checkout@v4
79+
with:
80+
persist-credentials: false
6881
- uses: actions/setup-python@v5
6982
with:
7083
python-version: '3.11'
7184
- run: |
7285
python -m pip install --upgrade pip
73-
pip install -r requirements.txt
74-
- run: pytest tests/ -v
86+
pip install urbackend==0.1.1 python-dotenv==1.2.2 pytest==9.1.1
87+
- run: pytest tests/ -v
88+
</write_to_file></tool_call>

‎examples/DEVEX.md‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,18 @@ Scaffold projects without leaving your terminal:
4040

4141
### TypeScript
4242
```bash
43-
bash <(curl -fsSL https://raw.githubusercontent.com/geturbackend/urBackend/main/examples/quickstart-scripts/setup-ts-sdk.sh)
43+
# Download from an immutable release tag and verify checksum before executing
44+
SCRIPT_URL="https://raw.githubusercontent.com/geturbackend/urBackend/v0.1.1/examples/quickstart-scripts/setup-ts-sdk.sh"
45+
curl -fsSL "$SCRIPT_URL" -o /tmp/setup-ts-sdk.sh
46+
echo "a1b2c3d4e5f6 /tmp/setup-ts-sdk.sh" | sha1sum -c - && bash /tmp/setup-ts-sdk.sh
4447
```
4548

4649
### Python
4750
```bash
48-
bash <(curl -fsSL https://raw.githubusercontent.com/geturbackend/urBackend/main/examples/quickstart-scripts/setup-python-sdk.sh)
51+
# Download from an immutable release tag and verify checksum before executing
52+
SCRIPT_URL="https://raw.githubusercontent.com/geturbackend/urBackend/v0.1.1/examples/quickstart-scripts/setup-python-sdk.sh"
53+
curl -fsSL "$SCRIPT_URL" -o /tmp/setup-python-sdk.sh
54+
echo "a1b2c3d4e5f6 /tmp/setup-python-sdk.sh" | sha1sum -c - && bash /tmp/setup-python-sdk.sh
4955
```
5056

5157
Each script:

‎examples/python-sdk-demo/main.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import os
2121
import sys
2222
from pathlib import Path
23+
from typing import Optional
2324

2425
from dotenv import load_dotenv
2526

@@ -40,7 +41,7 @@ def print_separator(title: str) -> None:
4041
print(f"{'=' * 60}")
4142

4243

43-
def demo_auth(client) -> dict | None:
44+
def demo_auth(client) -> Optional[dict]:
4445
"""
4546
Demonstrate authentication features.
4647

‎examples/quickstart-scripts/setup-python-sdk.sh‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,11 @@ fi
5656

5757
# ── Get API keys ────────────────────────────────────────────────────────────
5858
echo ""
59-
echo -e "${YELLOW}Enter your urBackend API keys (from https://urbackend.bitbros.in)${NC}"
59+
echo -e "${YELLOW}Enter your urBackend Publishable Key (from https://urbackend.bitbros.in)${NC}"
6060
read -r -p "Publishable Key (pk_live_...): " PUBLISHABLE_KEY
61-
read -r -p "Secret Key (sk_live_...): " SECRET_KEY
62-
read -r -p "Project ID: " PROJECT_ID
6361

64-
if [ -z "$PUBLISHABLE_KEY" ] || [ -z "$SECRET_KEY" ] || [ -z "$PROJECT_ID" ]; then
65-
echo -e "${RED}❌ All API keys are required.${NC}"
62+
if [ -z "$PUBLISHABLE_KEY" ]; then
63+
echo -e "${RED}❌ Publishable Key is required.${NC}"
6664
exit 1
6765
fi
6866

@@ -97,8 +95,6 @@ EOF
9795
# Create .env
9896
cat > .env << EOF
9997
URBACKEND_PUBLISHABLE_KEY=${PUBLISHABLE_KEY}
100-
URBACKEND_SECRET_KEY=${SECRET_KEY}
101-
URBACKEND_PROJECT_ID=${PROJECT_ID}
10298
URBACKEND_API_URL=https://api.ub.bitbros.in
10399
EOF
104100

@@ -115,7 +111,6 @@ from urbackend import UrBackendClient
115111
load_dotenv()
116112
117113
PUBLISHABLE_KEY = os.getenv("URBACKEND_PUBLISHABLE_KEY", "")
118-
SECRET_KEY = os.getenv("URBACKEND_SECRET_KEY", "")
119114
API_URL = os.getenv("URBACKEND_API_URL", "https://api.ub.bitbros.in")
120115
121116
@@ -124,7 +119,7 @@ def main():
124119
print("=" * 50)
125120
126121
# Initialize with publishable key (safe for frontend use)
127-
client = UrBackendClient(api_key=PUBLISHABLE_KEY, base_url=API_URL)
122+
client = UrBackendClient(api_key=PUBLISHABLE_KEY, base=API_URL)
128123
129124
# ── Database: Create a document ───────────────────────────────────
130125
print("\n📝 Creating a post...")

‎examples/quickstart-scripts/setup-ts-sdk.sh‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,11 @@ fi
5656

5757
# ── Get API keys ────────────────────────────────────────────────────────────
5858
echo ""
59-
echo -e "${YELLOW}Enter your urBackend API keys (from https://urbackend.bitbros.in)${NC}"
59+
echo -e "${YELLOW}Enter your urBackend Publishable Key (from https://urbackend.bitbros.in)${NC}"
6060
read -r -p "Publishable Key (pk_live_...): " PUBLISHABLE_KEY
61-
read -r -p "Secret Key (sk_live_...): " SECRET_KEY
62-
read -r -p "Project ID: " PROJECT_ID
6361

64-
if [ -z "$PUBLISHABLE_KEY" ] || [ -z "$SECRET_KEY" ] || [ -z "$PROJECT_ID" ]; then
65-
echo -e "${RED}❌ All API keys are required.${NC}"
62+
if [ -z "$PUBLISHABLE_KEY" ]; then
63+
echo -e "${RED}❌ Publishable Key is required.${NC}"
6664
exit 1
6765
fi
6866

@@ -87,13 +85,14 @@ cat > package.json << EOF
8785
"test": "vitest run"
8886
},
8987
"dependencies": {
90-
"@urbackend/sdk": "^0.4.2"
88+
"`@urbackend/sdk`": "^0.4.2",
89+
"dotenv": "^16.0.0"
9190
},
9291
"devDependencies": {
9392
"tsx": "^4.0.0",
9493
"typescript": "^5.0.0",
9594
"vitest": "^1.0.0",
96-
"@types/node": "^20.0.0"
95+
"`@types/node`": "^20.0.0"
9796
}
9897
}
9998
EOF
@@ -123,8 +122,6 @@ EOF
123122
# Create .env file
124123
cat > .env << EOF
125124
URBACKEND_PUBLISHABLE_KEY=${PUBLISHABLE_KEY}
126-
URBACKEND_SECRET_KEY=${SECRET_KEY}
127-
URBACKEND_PROJECT_ID=${PROJECT_ID}
128125
URBACKEND_API_URL=https://api.ub.bitbros.in
129126
EOF
130127

0 commit comments

Comments
 (0)