feat: proxy the Google OAuth handshake and close the shared-domain cookie leak

.dockerignore

@@ -1,22 +1,32 @@
 # deps
 **/node_modules
+.pnpm-store
 
 # builds
 apps/api/dist
-apps/cdn/dist
-apps/socials/.next
-apps/api-assets/.next
+apps/web/.next
+**/out
+**/build
+**/*.tsbuildinfo
 
 # turbo
 **/.turbo
-**/tsconfig.build.tsbuildinfo
 
-# env
+# env — the images ship only the examples (the API validates its env against .env.example)
 **/.env
 **/.env.*
 !**/.env.example
 
+# vcs / tooling
+.git
+.github
+.husky
+.claude
+
+# reference material (not part of the app)
+example
+
 # misc
 **/coverage
 **/*.md
-**/.claude
+**/.DS_Store

.env.example

@@ -1,21 +1,35 @@
+# Root environment — infrastructure + the web app (docker compose reads this file).
+# The API's own secrets live in apps/api/.env (see apps/api/.env.example).
+#
+#   cp .env.example .env
+
 # Database (PostgreSQL)
 DB_HOST="localhost"
 DB_PORT=5432
 DB_NAME="dropto"
 DB_USER="root"
 DB_PASS="password"
 
-# Redis
+# Redis (rate limiter)
 REDIS_PORT=6379
+REDIS_USER="default"
 REDIS_PASS="password"
+REDIS_KEY_PREFIX="dropto:"
 
 # URLs
 APP_URL="http://localhost:3000"
-NEXT_PUBLIC_API_URL="http://localhost:4000/api/v1"
 
 # Security
+# Auth-cookie domain. Use a shared parent in production (e.g. ".example.com") so the web app and the API can both read the cookies.
 COOKIE_DOMAIN="localhost"
 
-# Web build args
+# Branding (optional) — display name of this instance; defaults to "DropTo" when empty.
+APP_NAME="DropTo"
+
+# Web build args — inlined into the browser bundle at build time.
 NEXT_PUBLIC_GOOGLE_API_KEY="your_google_picker_api_key"
 NEXT_PUBLIC_GOOGLE_APP_ID="your_google_cloud_project_number"
+
+# Host ports the containers publish on, bound to 127.0.0.1 (docker compose only).
+WEB_PORT=3000
+API_PORT=4000

.github/workflows/ci.yml

@@ -0,0 +1,64 @@
+name: CI
+
+# Two-branch flow (dev → prod): fast feedback on every push to dev, and a gate on the PR into prod.
+on:
+  push:
+    branches: [dev]
+  pull_request:
+    branches: [prod]
+
+# A newer push to the same branch/PR supersedes the run in flight.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    name: lint · build · test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      # Reads the pnpm version from `packageManager` in package.json, so it cannot drift from local.
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: pnpm
+
+      # Turborepo's local cache: unchanged packages replay instead of re-running.
+      - name: Restore Turborepo cache
+        uses: actions/cache@v4
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.sha }}
+          restore-keys: turbo-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      # The lint scripts run eslint with --fix, so a fixable violation would be silently repaired and
+      # the step would pass. Failing on a dirty tree is what turns lint back into a real gate.
+      - name: Verify lint changed nothing
+        run: git diff --exit-code
+
+      - name: Build
+        run: pnpm build
+
+      - name: Unit tests (api)
+        run: pnpm --filter api run test
+
+      # Committed template of throwaway values — see the summary for why it is copied, not rebuilt here.
+      - name: Create the API test environment
+        run: cp apps/api/.env.test.example apps/api/.env.test
+
+      - name: E2E tests (api)
+        run: pnpm --filter api run test:e2e