fix(ENG-11821): env file#148
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Updates the developer sandbox .env.example files for the Vite and Next.js dev apps, aiming to switch default endpoints and document prod/local alternatives.
Changes:
- Switch default API/app URLs in the Vite sandbox
.env.example. - Switch default API/app URLs in the Next.js sandbox
.env.example. - Add commented “Prod” and “Local” endpoint blocks for reference.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| dev/vite/.env.example | Changes default API/app URLs and adds commented prod/local variants. |
| dev/nextjs/.env.example | Changes default API/app URLs and adds commented prod/local variants. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| API_URL=http://api.stackone-dev.com | ||
| DASHBOARD_URL=http://app.stackone-dev.com |
There was a problem hiding this comment.
These URLs are set to http://… even though the dev app sends the API key as an Authorization header when creating sessions. Using HTTP here would transmit credentials in plaintext; prefer https:// for non-local endpoints (or explicitly document why HTTP is required).
| API_URL=http://api.stackone-dev.com | |
| DASHBOARD_URL=http://app.stackone-dev.com | |
| API_URL=https://api.stackone-dev.com | |
| DASHBOARD_URL=https://app.stackone-dev.com |
| API_URL=http://api.stackone-dev.com | ||
| DASHBOARD_URL=http://app.stackone-dev.com | ||
| # Prod | ||
| # API_URL=https://api.stackone.com | ||
| # DASHBOARD_URL=https://app.stackone.com | ||
| # Local | ||
| # API_URL=http://localhost:4000 | ||
| # DASHBOARD_URL=http://localhost:3000 |
There was a problem hiding this comment.
The Next.js sandbox reads process.env.NEXT_PUBLIC_API_URL and NEXT_PUBLIC_APP_URL, but this example file now defines API_URL and DASHBOARD_URL. Copying this .env.example won’t configure the app and will cause it to fall back to the production defaults (https://api.stackone.com / https://app.stackone.com). Update the variable names to match what Next.js code expects (including the NEXT_PUBLIC_ prefix).
| API_URL=http://api.stackone-dev.com | |
| DASHBOARD_URL=http://app.stackone-dev.com | |
| # Prod | |
| # API_URL=https://api.stackone.com | |
| # DASHBOARD_URL=https://app.stackone.com | |
| # Local | |
| # API_URL=http://localhost:4000 | |
| # DASHBOARD_URL=http://localhost:3000 | |
| NEXT_PUBLIC_API_URL=http://api.stackone-dev.com | |
| NEXT_PUBLIC_APP_URL=http://app.stackone-dev.com | |
| # Prod | |
| # NEXT_PUBLIC_API_URL=https://api.stackone.com | |
| # NEXT_PUBLIC_APP_URL=https://app.stackone.com | |
| # Local | |
| # NEXT_PUBLIC_API_URL=http://localhost:4000 | |
| # NEXT_PUBLIC_APP_URL=http://localhost:3000 |
| API_URL=http://api.stackone-dev.com | ||
| DASHBOARD_URL=http://app.stackone-dev.com |
There was a problem hiding this comment.
The example uses http://api.stackone-dev.com, but the Next.js page explicitly refuses to send the API key unless NEXT_PUBLIC_API_URL is HTTPS or localhost. Even after renaming the env vars, keeping an HTTP dev URL here will make token creation fail (and/or encourage insecure configs). Switch these dev endpoints to https:// if they support it, or update the safety check/docs accordingly.
| API_URL=http://api.stackone-dev.com | |
| DASHBOARD_URL=http://app.stackone-dev.com | |
| API_URL=https://api.stackone-dev.com | |
| DASHBOARD_URL=https://app.stackone-dev.com |
| API_URL=http://api.stackone-dev.com | ||
| DASHBOARD_URL=http://app.stackone-dev.com | ||
| # Prod | ||
| # API_URL=https://api.stackone.com | ||
| # DASHBOARD_URL=https://app.stackone.com | ||
| # Local | ||
| # API_URL=http://localhost:4000 | ||
| # DASHBOARD_URL=http://localhost:3000 |
There was a problem hiding this comment.
The Vite dev app reads URLs from import.meta.env.VITE_API_URL / VITE_APP_URL (and other vars are VITE_*), but this example file defines API_URL and DASHBOARD_URL. Copying this .env.example will therefore fall back to the production defaults in code instead of using the intended dev/local endpoints. Rename these keys to the VITE_* names used by the Vite app (and keep naming consistent with APP_URL, not DASHBOARD_URL).
| API_URL=http://api.stackone-dev.com | |
| DASHBOARD_URL=http://app.stackone-dev.com | |
| # Prod | |
| # API_URL=https://api.stackone.com | |
| # DASHBOARD_URL=https://app.stackone.com | |
| # Local | |
| # API_URL=http://localhost:4000 | |
| # DASHBOARD_URL=http://localhost:3000 | |
| VITE_API_URL=http://api.stackone-dev.com | |
| VITE_APP_URL=http://app.stackone-dev.com | |
| # Prod | |
| # VITE_API_URL=https://api.stackone.com | |
| # VITE_APP_URL=https://app.stackone.com | |
| # Local | |
| # VITE_API_URL=http://localhost:4000 | |
| # VITE_APP_URL=http://localhost:3000 |
Summary by cubic
Updated .env examples for Next.js and Vite to default to StackOne dev endpoints. Added commented prod/local values and aligned keys to API_URL and DASHBOARD_URL (replacing NEXT_PUBLIC_* in Next.js).
Written for commit dd05ca5. Summary will update on new commits. Review in cubic