Ajout pre-commit hook anti-secrets et renforcement .gitignore

Pas besoin de publier...

.env.cloud

@@ -1,4 +0,0 @@
-VITE_SUPABASE_URL=https://moiqhcezwasgwtvsomsz.supabase.co
-VITE_SUPABASE_ANON_KEY=sb_publishable_hVDEwtTrHzEV0cJzzMD6bQ_jfiFpeey
-VITE_SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im1vaXFoY2V6d2FzZ3d0dnNvbXN6Iiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTc3OTY0NDM4MiwiZXhwIjoyMDk1MjIwMzgyfQ.JFb5krGgfOQjQR-u1DddMNWW-jxz7pznTznfh03_UQo
-

.env.home

@@ -1,3 +0,0 @@
-VITE_SUPABASE_URL=http://vm-docker5.home.arpa:8000
-VITE_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzc5NjI5NDcwLCJleHAiOjE5MzczMDk0NzB9.TYjH0aUQDd0y1D0uMr7dOz-MC4Ltz9ufxhZldpK0wBM
-VITE_SUPABASE_SERVICE_ROLE_KEY==eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIiwiaXNzIjoic3VwYWJhc2UiLCJpYXQiOjE3Nzk2Mjk0NzAsImV4cCI6MTkzNzMwOTQ3MH0.OB2bB7TGeT7TzxvtWbtk9EZ7pkoxfnLmZustByIGPZo

.env.production

@@ -1,2 +0,0 @@
-VITE_SUPABASE_URL=https://moiqhcezwasgwtvsomsz.supabase.co
-VITE_SUPABASE_ANON_KEY=sb_publishable_hVDEwtTrHzEV0cJzzMD6bQ_jfiFpeey

.githooks/pre-commit

@@ -0,0 +1,81 @@
+#!/bin/sh
+
+RED='\033[0;31m'
+NC='\033[0m'
+
+detected=false
+
+check_file() {
+    while IFS=: read -r file score; do
+        [ -z "$file" ] && continue
+        detected=true
+    done <<EOF
+$(git diff --cached --name-only | while read -r f; do
+    [ ! -f "$f" ] && continue
+    case "$f" in
+        .env|.env.*)
+            [ "$f" = ".env.example" ] && continue
+            echo "$f|1"
+            ;;
+    esac
+    case "$(basename "$f")" in
+        .env|.env.*)
+            [ "$f" = ".env.example" ] && continue
+            echo "$f|1"
+            ;;
+    esac
+done)
+EOF
+}
+
+check_diff() {
+    content=$(git diff --cached --diff-filter=ACM -- "$@" 2>/dev/null)
+    [ -z "$content" ] && return
+
+    patterns='VITE_SUPABASE_SERVICE_ROLE_KEY|SUPABASE_SERVICE_ROLE|eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9|ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|sk_live_|sk_test_|AKIA[0-9A-Z]{16}|-----BEGIN[ A-Z]*PRIVATE KEY-----'
+
+    echo "$content" | while read -r line; do
+        case "$line" in
+            *VITE_SUPABASE_SERVICE_ROLE_KEY*)
+                printf "${RED}⛔ Secret détecté : VITE_SUPABASE_SERVICE_ROLE_KEY (clé admin Supabase)${NC}\n"
+                return 1
+                ;;
+            *eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9*)
+                printf "${RED}⛔ Secret détecté : JWT token (eyJ...) dans le diff${NC}\n"
+                return 1
+                ;;
+            *ghp_*|*gho_*)
+                printf "${RED}⛔ Secret détecté : GitHub token (ghp_/gho_)${NC}\n"
+                return 1
+                ;;
+            *sk_live_*|*sk_test_*)
+                printf "${RED}⛔ Secret détecté : clé Stripe${NC}\n"
+                return 1
+                ;;
+            *AKIA[0-9A-Z]*)
+                printf "${RED}⛔ Secret détecté : clé AWS (AKIA)${NC}\n"
+                return 1
+                ;;
+            *-----BEGIN*PRIVATE*KEY*-----*)
+                printf "${RED}⛔ Secret détecté : clé privée RSA/EC${NC}\n"
+                return 1
+                ;;
+        esac
+    done
+}
+
+check_file
+
+for f in $(git diff --cached --name-only); do
+    case "$f" in .githooks/*) continue ;; esac
+    check_diff "$f"
+    [ $? -eq 1 ] && detected=true
+done
+
+if [ "$detected" = true ]; then
+    printf "${RED}⛔ Commit bloqué : secret(s) détecté(s) dans les fichiers indexés.${NC}\n"
+    printf "  Vérifie le contenu et utilise 'git rm --cached' si nécessaire.\n"
+    exit 1
+fi
+
+exit 0

.gitignore

@@ -26,6 +26,8 @@ dist-ssr
 # Environment
 .env
 .env.local
+.env.*
+!.env.example
 
 # OpenCode Stuff
 .agents/*