openvibers/openvibe.tools Commits

maps: no RIDB API key in the code. RIDB_API_KEY comes from the environment only (set in production's /etc/openvibe/tools.env on 2026-09-27, before this deploy); without it RIDB is skipped with one warning. The two keys that were defaults here are in the repository's history and should be rotated at ridb.recreation.gov (the unused config one can simply be dropped).

OP OpenVibers committed 27 Sept 2026 · b635f975ac · 2 files, +7 −3





Changes
ddiff --git a/apps/maps/server/config.js b/apps/maps/server/config.js
iindex 73cfff3..4d43920 100644
---- a/apps/maps/server/config.js
++++ b/apps/maps/server/config.js
@@@ -7,7 +7,7 @@ module.exports = {
    baseUrl: process.env.BASE_URL || 'https://maps.openvibe.tools',
  
    // API Keys (optional — free tiers work without most of these)
--  ridbApiKey: process.env.RIDB_API_KEY || '10b1607f-2064-44f4-b438-cf6413eaa0b2',
++  ridbApiKey: process.env.RIDB_API_KEY || '',   // sources/ridb.js reads RIDB_API_KEY itself; never a key in the code
    npsApiKey: process.env.NPS_API_KEY || '',
    openChargeMapKey: process.env.OPEN_CHARGE_MAP_KEY || '',
  
ddiff --git a/apps/maps/server/sources/ridb.js b/apps/maps/server/sources/ridb.js
iindex d45e92f..ed67ddd 100644
---- a/apps/maps/server/sources/ridb.js
++++ b/apps/maps/server/sources/ridb.js
@@@ -9,8 +9,9 @@
  const axios = require('axios');
  const { haversine } = require('./utils');
  
--// Use env var RIDB_API_KEY if set, otherwise fall back to default key
--const API_KEY = process.env.RIDB_API_KEY || '10157187-d1f3-4c78-a3c2-5a4d8c23d715';
++// RIDB_API_KEY from the environment (/etc/openvibe/tools.env in production); never a key in the code.
++// Without one, RIDB is skipped (search answers the other sources).
++const API_KEY = process.env.RIDB_API_KEY || '';
  const BASE_URL = 'https://ridb.recreation.gov/api/v1';
  let _ridbDisabled = false; // Disable after first 401 to avoid duplicate errors
  
@@@ -26,7 +27,10 @@ const CAMPING_ACTIVITY_IDS = [
  /**
   * Search RIDB for facilities near lat/lon within radiusMiles
   */
++let _warnedNoKey = false;
++
  async function search(lat, lon, radiusMiles) {
++  if (!API_KEY) { if (!_warnedNoKey) { _warnedNoKey = true; console.warn('[RIDB] RIDB_API_KEY is not set: RIDB results are skipped'); } return []; }
    if (_ridbDisabled) return []; // Skip after auth failure
    const results = [];