Configuration
Reference: .env.example. All values are public.
| Variable | Read in | Dev (.env.development) | Prod (.env.production) |
|---|---|---|---|
VITE_BACKEND_URL | src/constants/backendIp.js | https://dev.emaw-app.com/ | https://app.emaw-app.com/ |
VITE_WEBSITE_URL | src/constants/websiteUrl.js | the dev website | the production website |
VITE_GOOGLE_CLIENT_ID | src/constants/googleClientId.js | web client id | same |
VITE_HMR_HOST | vite.config.js (dev only) | unset | unset |
Committed env files
.env.development and .env.production are tracked in git on purpose (even though .gitignore lists .env.*), because the GitHub workflows build from them. Override locally with .env.development.local. Never put a secret in any of them; the client id is a public identifier.
Token storage
| Token | Where |
|---|---|
| Access | localStorage.token |
| Refresh | localStorage.refreshToken, sent in the request body on refresh (the backend's HttpOnly cookie is third-party from this origin and Safari never sends it) |
Logout revokes the refresh token on the backend so a reload cannot silently sign back in. src/store/AuthContextProvider.jsx validates the stored token at startup with GET /rest/validate/token and refreshes if needed.
Vite config
vite.config.js: SWC React plugin, @ alias to src/, allowedHosts: true with an ngrok header for tunnelled dev, hashed asset file names.