[object Object]

← back to Hollywood Optc

security: strip hardcoded dw_admin secret -> env-first/passwordless. No rotation/deploy.

e18e1c0d66a13169e72f86fb10d31aa8b4738d5a · 2026-09-13 00:21:58 -0700 · Steve

Files touched

Diff

commit e18e1c0d66a13169e72f86fb10d31aa8b4738d5a
Author: Steve <steve@designerwallcoverings.com>
Date:   Sun Sep 13 00:21:58 2026 -0700

    security: strip hardcoded dw_admin secret -> env-first/passwordless. No rotation/deploy.
---
 build-hwc-map.mjs       | 2 +-
 build-restore-map.mjs   | 2 +-
 order-history-check.mjs | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/build-hwc-map.mjs b/build-hwc-map.mjs
index e8042e6..112e870 100644
--- a/build-hwc-map.mjs
+++ b/build-hwc-map.mjs
@@ -22,7 +22,7 @@ const TOKEN = (env.split('\n').find(l => l.startsWith('SHOPIFY_ADMIN_TOKEN=')) |
   .replace('SHOPIFY_ADMIN_TOKEN=', '').replace(/["'\r]/g, '').trim();
 if (!TOKEN) { console.error('no SHOPIFY_ADMIN_TOKEN'); process.exit(1); }
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024!@127.0.0.1:5432/dw_unified?host=/tmp' });
+const pool = new Pool({ connectionString: (process.env.PGCONNSTRING || 'postgresql://dw_admin@127.0.0.1:5432/dw_unified?host=/tmp') });
 const BASE = `status='ACTIVE' AND variant_sku ~ '^DWHD' AND (metafields->'dwc'->'real_vendor'->>'value')='Momentum'`;
 
 async function getJSON(url, tries = 0) {
diff --git a/build-restore-map.mjs b/build-restore-map.mjs
index 8b197c7..eb2d863 100644
--- a/build-restore-map.mjs
+++ b/build-restore-map.mjs
@@ -17,7 +17,7 @@ const PL_PREFIX = process.env.HW_PL_PREFIX || 'HW';
 const HASH_LEN  = Number(process.env.HW_HASH_LEN || 12);
 const plSku = num => `${PL_PREFIX}-${createHash('sha256').update(String(num)).digest('hex').slice(0, HASH_LEN).toUpperCase()}`;
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024!@127.0.0.1:5432/dw_unified?host=/tmp' });
+const pool = new Pool({ connectionString: (process.env.PGCONNSTRING || 'postgresql://dw_admin@127.0.0.1:5432/dw_unified?host=/tmp') });
 
 const BASE = `status='ACTIVE' AND variant_sku ~ '^DWHD' AND (metafields->'dwc'->'real_vendor'->>'value')='Momentum'`;
 
diff --git a/order-history-check.mjs b/order-history-check.mjs
index d202a94..f0ba725 100644
--- a/order-history-check.mjs
+++ b/order-history-check.mjs
@@ -18,7 +18,7 @@ const TOKEN = (readFileSync(process.env.HOME + '/Projects/secrets-manager/.env',
   .replace('SHOPIFY_FULL_ACCESS_TOKEN=', '').replace(/["'\r]/g, '').trim();
 if (!TOKEN) { console.error('no SHOPIFY_FULL_ACCESS_TOKEN'); process.exit(1); }
 
-const pool = new Pool({ connectionString: 'postgresql://dw_admin:DW2024!@127.0.0.1:5432/dw_unified?host=/tmp' });
+const pool = new Pool({ connectionString: (process.env.PGCONNSTRING || 'postgresql://dw_admin@127.0.0.1:5432/dw_unified?host=/tmp') });
 const BASE = `status='ACTIVE' AND variant_sku ~ '^DWHD' AND (metafields->'dwc'->'real_vendor'->>'value')='Momentum'`;
 
 async function targetSkus() {

← 3e8736f auto-data-snapshot: 2026-08-28T01:33:48 (3 data files) — dat  ·  back to Hollywood Optc  ·  chore: version bump (session close, TK-11480 security fix) ba71f7f →