|
| 1 | +<% |
| 2 | + const arkenvOption = (typeof addOnOption !== 'undefined' && ( |
| 3 | + addOnOption['arkenv'] || |
| 4 | + Object.entries(addOnOption).find(([k]) => k.includes('arkenv') || k.includes('info.json'))?.[1] |
| 5 | + )) || {}; |
| 6 | + const includeDemo = typeof includeExamples !== 'undefined' ? includeExamples : true; |
| 7 | + if (arkenvOption.demo === 'false' || !includeDemo) { |
| 8 | + if (typeof ignoreFile === 'function') { |
| 9 | + ignoreFile(); |
| 10 | + return; |
| 11 | + } |
| 12 | + } |
| 13 | +-%> |
| 14 | +import { createFileRoute } from "@tanstack/react-router"; |
| 15 | +import { createServerFn } from "@tanstack/react-start"; |
| 16 | +import { useState } from "react"; |
| 17 | +import { env } from "../../env"; |
| 18 | +
|
| 19 | +const getDatabaseConfig = createServerFn({ method: "GET" }).handler(() => { |
| 20 | + // Server-only key: safely read on the server during SSR / RPC |
| 21 | + try { |
| 22 | + const url = new URL(env.DATABASE_URL); |
| 23 | + return { host: url.host, protocol: url.protocol }; |
| 24 | + } catch { |
| 25 | + return { host: "localhost:5432", protocol: "postgresql:" }; |
| 26 | + } |
| 27 | +}); |
| 28 | +
|
| 29 | +export const Route = createFileRoute("/demo/arkenv")({ |
| 30 | + component: ArkEnvDemo, |
| 31 | + loader: () => getDatabaseConfig(), |
| 32 | +}); |
| 33 | +
|
| 34 | +function LeakedSecret() { |
| 35 | + // Accessing server-only DATABASE_URL directly on the client throws at runtime |
| 36 | + return <p>Server key leaked: {env.DATABASE_URL}</p>; |
| 37 | +} |
| 38 | +
|
| 39 | +function ArkEnvDemo() { |
| 40 | + const dbConfig = Route.useLoaderData(); |
| 41 | + const [attemptLeak, setAttemptLeak] = useState(false); |
| 42 | +
|
| 43 | + return ( |
| 44 | + <div className="p-6 max-w-xl mx-auto space-y-4 font-sans"> |
| 45 | + <h1 className="text-2xl font-bold">ArkEnv Demo</h1> |
| 46 | + <p className="text-sm text-gray-600"> |
| 47 | + Typesafe environment variables with build-time validation and runtime |
| 48 | + leak protection. |
| 49 | + </p> |
| 50 | +
|
| 51 | + <div className="p-4 bg-gray-100 dark:bg-gray-800 rounded-md space-y-2"> |
| 52 | + <h2 className="font-semibold text-lg">Public Client Variables</h2> |
| 53 | + <p className="text-sm text-gray-600 dark:text-gray-300"> |
| 54 | + Inlined safely into client bundles: |
| 55 | + </p> |
| 56 | + <code className="block p-2 bg-white dark:bg-black rounded border text-xs font-mono"> |
| 57 | + env.VITE_API_URL: {env.VITE_API_URL} |
| 58 | + </code> |
| 59 | + </div> |
| 60 | +
|
| 61 | + <div className="p-4 bg-gray-100 dark:bg-gray-800 rounded-md space-y-2"> |
| 62 | + <h2 className="font-semibold text-lg">Server-Only Variables</h2> |
| 63 | + <p className="text-sm text-gray-600 dark:text-gray-300"> |
| 64 | + Accessible inside createServerFn handlers: |
| 65 | + </p> |
| 66 | + <code className="block p-2 bg-white dark:bg-black rounded border text-xs font-mono"> |
| 67 | + Database Host: {dbConfig.host} ({dbConfig.protocol}) |
| 68 | + </code> |
| 69 | + </div> |
| 70 | +
|
| 71 | + <div className="p-4 bg-red-50 dark:bg-red-950/30 border border-red-200 dark:border-red-900 rounded-md space-y-2"> |
| 72 | + <h2 className="font-semibold text-red-800 dark:text-red-300 text-lg"> |
| 73 | + Secret Leak Protection |
| 74 | + </h2> |
| 75 | + <p className="text-sm text-red-700 dark:text-red-400"> |
| 76 | + Clicking the button below attempts to access the server secret{" "} |
| 77 | + <code>env.DATABASE_URL</code> on the client, which ArkEnv blocks: |
| 78 | + </p> |
| 79 | + {attemptLeak ? ( |
| 80 | + <LeakedSecret /> |
| 81 | + ) : ( |
| 82 | + <button |
| 83 | + type="button" |
| 84 | + className="px-3 py-1.5 bg-red-600 text-white rounded text-sm hover:bg-red-700 cursor-pointer" |
| 85 | + onClick={() => setAttemptLeak(true)} |
| 86 | + > |
| 87 | + Attempt client access to DATABASE_URL |
| 88 | + </button> |
| 89 | + )} |
| 90 | + </div> |
| 91 | + </div> |
| 92 | + ); |
| 93 | +} |
![autofix-ci[bot]](https://avatars.githubusercontent.com/in/243519?v=4&size=40){kind=avatar}
0 commit comments