v4.0.0.2

2026-05-26 08:30:08 +12:00
parent 005aab8139
commit 135a5a3b83
75 changed files with 22417 additions and 4288 deletions
@@ -27,6 +27,12 @@ RATE_LIMIT_MAX_PER_EMAIL=3
 RATE_LIMIT_MIN_INTERVAL_SECONDS=20
 EMAIL_SEND_TIMEOUT_SECONDS=20

+# Shared secret for the post-deploy form smoke tests. The deploy script reads
+# this from the live remote .env and presents it via X-Deploy-Smoke; the
+# mail-api short-circuits matching requests before email/db side effects.
+# Rotate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+DEPLOY_SMOKE_SECRET=ed7261d3d7a5ac0a51e0cfb2bf4e2bd4009503605d2963d3ee766b7e885e76eb
+
 # Security hardening — sensible defaults are in mail_api/config.py.
 # Override only if the public domains change or you need to allow extra origins.
 # CORS_ALLOWED_ORIGINS=https://goodwalk.co.nz,https://www.goodwalk.co.nz,https://clients.goodwalk.co.nz,https://cp.goodwalk.co.nz