Strip API_BASE_URL and ApiKey -- nothing uses either #452

New issue

Closed

opened 2026-09-02 18:34:31 +02:00 by johnsturgeon · 0 comments

johnsturgeon commented

2026-09-02 18:34:31 +02:00

Owner

Both are leftovers from an external-trigger REST API that was never built.

`API_BASE_URL`

app/config/config.py:45    API_BASE_URL: str
app/config/config.py:80    API_BASE_URL=os.environ["API_BASE_URL"],

Declared, required at startup, read from 1Password, consumed by nothing. Its
production value is https://tgfp.us/api, which is not a route the app serves.

Because Config.get_config() raises KeyError on the first missing variable,
every environment -- production, development, and the test suite's
_seed_test_environment() -- has to supply it for the app to import at all.

Related to #199.

`ApiKey`

class ApiKey(TGFPModelBase, SQLModel, table=True):
    token: str = Field(index=True, unique=True, description="API token string")
    description: str

A table, registered in app/models/__init__.py, referenced by no auth code
anywhere. No route validates a token.

It is also in rebuild_database.sh's PRESERVE list, so the August 2026
production rebuild carefully dumped and restored one row of credentials that
nothing can authenticate against, and the script's comment explains why they
matter.

What to do

Drop both, plus:

the API_BASE_URL line in config/op.env and the 1Password items behind it
apikey from PRESERVE in scripts/rebuild_database.sh, and the sentence
in its header comment that justifies it
a migration dropping the apikey table

If an external trigger API is still wanted, that is a new design against the
current auth story, not these two.

Both are leftovers from an external-trigger REST API that was never built. ## `API_BASE_URL` ``` app/config/config.py:45 API_BASE_URL: str app/config/config.py:80 API_BASE_URL=os.environ["API_BASE_URL"], ``` Declared, required at startup, read from 1Password, consumed by nothing. Its production value is `https://tgfp.us/api`, which is not a route the app serves. Because `Config.get_config()` raises `KeyError` on the first missing variable, every environment -- production, development, and the test suite's `_seed_test_environment()` -- has to supply it for the app to import at all. Related to #199. ## `ApiKey` ```python class ApiKey(TGFPModelBase, SQLModel, table=True): token: str = Field(index=True, unique=True, description="API token string") description: str ``` A table, registered in `app/models/__init__.py`, referenced by no auth code anywhere. No route validates a token. It is also in `rebuild_database.sh`'s `PRESERVE` list, so the August 2026 production rebuild carefully dumped and restored one row of credentials that nothing can authenticate against, and the script's comment explains why they matter. ## What to do Drop both, plus: - the `API_BASE_URL` line in `config/op.env` and the 1Password items behind it - `apikey` from `PRESERVE` in `scripts/rebuild_database.sh`, and the sentence in its header comment that justifies it - a migration dropping the `apikey` table If an external trigger API is still wanted, that is a new design against the current auth story, not these two.

johnsturgeon referenced this issue

2026-09-02 20:47:31 +02:00

Add SITE_BASE_URL to config #456

johnsturgeon referenced this issue

2026-09-03 11:56:27 +02:00

Reduce the number of unnecessary .env vars #199

johnsturgeon referenced this issue from a commit

2026-09-03 12:28:22 +02:00

Removed API_BASE_URL and replaced with SITE_BASE_URL

johnsturgeon referenced this issue from a pull request that will close it,

2026-09-03 12:28:43 +02:00

Removed API_BASE_URL and replaced with SITE_BASE_URL #458