[object Object]

← back to Designer Wallcoverings

TK-11783: strip hardcoded Google OAuth client secret from sheets-auth python; read from env via _env loader

82c219e278a0670a965c2e50a918187345044db3 · 2026-09-22 13:35:26 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G3ChReG53fwpNgUESv4SY7

Files touched

Diff

commit 82c219e278a0670a965c2e50a918187345044db3
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Sep 22 13:35:26 2026 -0700

    TK-11783: strip hardcoded Google OAuth client secret from sheets-auth python; read from env via _env loader
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01G3ChReG53fwpNgUESv4SY7
---
 shopify/scripts/_env.py                    | 29 +++++++++++++++++++++++++++++
 shopify/scripts/get-sheets-auth.py         |  4 +++-
 shopify/scripts/get-sheets-token-manual.py |  4 +++-
 shopify/scripts/get-sheets-token.py        |  4 +++-
 shopify/scripts/sheets-auth-desktop.py     |  4 +++-
 shopify/scripts/sheets-auth-server.py      |  4 +++-
 shopify/scripts/update-spreadsheet.py      |  8 +++++---
 7 files changed, 49 insertions(+), 8 deletions(-)

diff --git a/shopify/scripts/_env.py b/shopify/scripts/_env.py
new file mode 100644
index 00000000..dee34560
--- /dev/null
+++ b/shopify/scripts/_env.py
@@ -0,0 +1,29 @@
+"""Zero-dependency .env loader for the DW-shopify scripts (TK-11783 secret-strip).
+
+Populates os.environ from the gitignored repo-root .env / .env.local so OAuth creds
+resolve from env instead of being hardcoded in tracked source. No python-dotenv dep.
+Only sets vars NOT already present, so a pipeline-exported value always wins (no-op).
+Rotation of these keys stays Steve's console action (TK-11783) — this only moves the
+value out of tracked source.
+
+Usage (near the top of a script, before reading os.environ["..."]):
+    import _env; _env.load()
+"""
+import os
+import pathlib
+
+
+def load():
+    root = pathlib.Path(__file__).resolve().parent.parent
+    for name in (".env", ".env.local"):
+        p = root / name
+        if not p.exists():
+            continue
+        for line in p.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, val = line.partition("=")
+            key = key.strip()
+            if key and key not in os.environ:
+                os.environ[key] = val.strip().strip('"').strip("'")
diff --git a/shopify/scripts/get-sheets-auth.py b/shopify/scripts/get-sheets-auth.py
index df80806c..2338c21b 100644
--- a/shopify/scripts/get-sheets-auth.py
+++ b/shopify/scripts/get-sheets-auth.py
@@ -2,9 +2,11 @@
 """Get Google Sheets OAuth token - open URL in browser"""
 
 import urllib.parse
+import os
+import _env; _env.load()  # load gitignored shopify/.env (TK-11783 secret-strip)
 
 CLIENT_ID = "691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7.apps.googleusercontent.com"
-CLIENT_SECRET = "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"
+CLIENT_SECRET = os.environ["GOOGLE_CLIENT_SECRET"]  # fail-loud KeyError if unset
 REDIRECT_URI = "urn:ietf:wg:oauth:2.0:oob"
 SCOPES = "https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive"
 
diff --git a/shopify/scripts/get-sheets-token-manual.py b/shopify/scripts/get-sheets-token-manual.py
index 31afcca9..f91914a7 100644
--- a/shopify/scripts/get-sheets-token-manual.py
+++ b/shopify/scripts/get-sheets-token-manual.py
@@ -7,9 +7,11 @@ Manual OAuth flow for Google Sheets.
 """
 
 import urllib.parse
+import os
+import _env; _env.load()  # load gitignored shopify/.env (TK-11783 secret-strip)
 
 CLIENT_ID = "691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7.apps.googleusercontent.com"
-CLIENT_SECRET = "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"
+CLIENT_SECRET = os.environ["GOOGLE_CLIENT_SECRET"]  # fail-loud KeyError if unset
 REDIRECT_URI = "urn:ietf:wg:oauth:2.0:oob"  # Manual copy/paste flow
 SCOPES = "https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive"
 
diff --git a/shopify/scripts/get-sheets-token.py b/shopify/scripts/get-sheets-token.py
index 1a48c366..06ecd3b7 100644
--- a/shopify/scripts/get-sheets-token.py
+++ b/shopify/scripts/get-sheets-token.py
@@ -4,13 +4,15 @@ Get new OAuth token with Google Sheets scope.
 Run this script, then open the URL in your browser to authorize.
 """
 
+import os
+import _env; _env.load()  # load gitignored shopify/.env (TK-11783 secret-strip)
 from google_auth_oauthlib.flow import InstalledAppFlow
 
 # OAuth credentials from DW-MCP
 CLIENT_CONFIG = {
     "installed": {
         "client_id": "691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7.apps.googleusercontent.com",
-        "client_secret": "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",
+        "client_secret": os.environ["GOOGLE_CLIENT_SECRET"],  # fail-loud KeyError if unset
         "redirect_uris": ["http://localhost"],
         "auth_uri": "https://accounts.google.com/o/oauth2/auth",
         "token_uri": "https://oauth2.googleapis.com/token"
diff --git a/shopify/scripts/sheets-auth-desktop.py b/shopify/scripts/sheets-auth-desktop.py
index 350caf96..aff5c8f6 100644
--- a/shopify/scripts/sheets-auth-desktop.py
+++ b/shopify/scripts/sheets-auth-desktop.py
@@ -3,11 +3,13 @@
 
 from google_auth_oauthlib.flow import InstalledAppFlow
 import json
+import os
+import _env; _env.load()  # load gitignored shopify/.env (TK-11783 secret-strip)
 
 CLIENT_CONFIG = {
     "installed": {
         "client_id": "691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7.apps.googleusercontent.com",
-        "client_secret": "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",
+        "client_secret": os.environ["GOOGLE_CLIENT_SECRET"],  # fail-loud KeyError if unset
         "auth_uri": "https://accounts.google.com/o/oauth2/auth",
         "token_uri": "https://oauth2.googleapis.com/token",
         "redirect_uris": ["http://localhost"]
diff --git a/shopify/scripts/sheets-auth-server.py b/shopify/scripts/sheets-auth-server.py
index cd503c4a..449133d1 100644
--- a/shopify/scripts/sheets-auth-server.py
+++ b/shopify/scripts/sheets-auth-server.py
@@ -6,9 +6,11 @@ import urllib.parse
 import requests
 import json
 import webbrowser
+import os
+import _env; _env.load()  # load gitignored shopify/.env (TK-11783 secret-strip)
 
 CLIENT_ID = "691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7.apps.googleusercontent.com"
-CLIENT_SECRET = "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"
+CLIENT_SECRET = os.environ["GOOGLE_CLIENT_SECRET"]  # fail-loud KeyError if unset
 REDIRECT_URI = "http://localhost:8085"
 SCOPES = "https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive"
 
diff --git a/shopify/scripts/update-spreadsheet.py b/shopify/scripts/update-spreadsheet.py
index 39901665..3b7464b1 100644
--- a/shopify/scripts/update-spreadsheet.py
+++ b/shopify/scripts/update-spreadsheet.py
@@ -2,12 +2,14 @@
 """Update Google Spreadsheet with Adalyn Weave colors using OAuth credentials"""
 
 import gspread
+import os
+import _env; _env.load()  # load gitignored shopify/.env (TK-11783 secret-strip)
 from google.oauth2.credentials import Credentials
 
-# OAuth credentials from DW-MCP
+# OAuth credentials — read from gitignored shopify/.env (fail-loud KeyError if unset)
 CLIENT_ID = "691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7.apps.googleusercontent.com"
-CLIENT_SECRET = "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"
-REFRESH_TOKEN = "1//06OUGq-asVOnRCgYIARAAGAYSNwF-L9IrTfIzRnpDBmb-dd_2aNdvrKdICTn1dqL8wsC0CIhZ3TnpSmwjqTvjE-_iuQ_oouqwfDQ"
+CLIENT_SECRET = os.environ["GOOGLE_CLIENT_SECRET"]
+REFRESH_TOKEN = os.environ["GOOGLE_REFRESH_TOKEN"]
 
 # Spreadsheet ID (Type 2 Vinyl)
 SPREADSHEET_ID = "1FYG7TGUUiim_RL25YJx5R9tBcgL3ilFlLy3dQISVSMo"

← 76f11f71 TK-11857 R1/R4: price-integrity gate fails closed on non-boo  ·  back to Designer Wallcoverings  ·  TK-11786: fail-loud --apply/--dry-run guards on push + singl a939ff3d →