Loading application...

StratoFusion

📚 Documentation

← Back to App

Documentation/OAuth Environment Inventory

OAuth Environment Inventory

Source: OAUTH_ENVIRONMENT_INVENTORY_2026-03-19.md

OAuth Environment Inventory (March 19, 2026)

Historical evidence: This inventory records the environment state on March 19, 2026. The permanent shared development environment has since been retired. Do not use its Vercel, Neon, Fly.io, or OAuth references as current setup instructions; follow the current deployment and OAuth runbooks.

Scope

This inventory covers the Phase 5 provider OAuth separation work for:

Google.
OneDrive.
Dropbox.

It records where provider OAuth credentials are consumed and whether dev/prod are currently separated.

Current Finding

Provider redirect URIs are already environment-specific, but the actual provider client IDs and client secrets are still shared between dev and prod.

That means Phase 5 is not complete yet.

Application Consumers

Primary runtime consumers in the Next.js app:

src/lib/oauth.ts.
src/lib/service-token-refresh.ts.
src/config/services/google.config.ts.
src/config/services/onedrive.config.ts.
src/config/services/dropbox.config.ts.

Primary route consumers:

src/app/api/google/route.ts.
src/app/api/onedrive/route.ts.
src/app/api/dropbox/route.ts.
src/app/api/auth/refresh/route.ts.
provider-specific upload, create-folder, open, and debug routes that call the shared OAuth helpers.

Primary Fly.io surface:

fly-rclone/deploy.sh.
fly-rclone/.env.example.template.

Vercel Inventory

Production env variable slots exist for:

GOOGLE_CLIENT_ID.
GOOGLE_CLIENT_SECRET.
GOOGLE_REDIRECT_URI.
ONEDRIVE_CLIENT_ID.
ONEDRIVE_CLIENT_SECRET.
ONEDRIVE_REDIRECT_URI.
DROPBOX_CLIENT_ID.
DROPBOX_CLIENT_SECRET.
DROPBOX_REDIRECT_URI.

Dev and prod comparison from pulled Vercel env files:

Google client ID: same.
Google client secret: same.
Google redirect URI: different.
OneDrive client ID: same.
OneDrive client secret: same.
OneDrive redirect URI: different.
Dropbox client ID: same.
Dropbox client secret: same.
Dropbox redirect URI: different.

Meaning:

The app/project wiring is already in place.
The actual provider apps are still shared between dev and prod.

Fly.io Inventory

Both Fly apps have provider secret slots populated:

stratofusion-rclone-dev.
stratofusion-rclone-prod.

Secret-name comparison showed identical deployed digests for:

GOOGLE_CLIENT_ID.
GOOGLE_CLIENT_SECRET.
ONEDRIVE_CLIENT_ID.
ONEDRIVE_CLIENT_SECRET.
DROPBOX_CLIENT_ID.
DROPBOX_CLIENT_SECRET.

Meaning:

Fly dev and Fly prod are also still sharing provider credentials.

Current implementation detail:

The Fly service does not currently read GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, ONEDRIVE_CLIENT_ID, ONEDRIVE_CLIENT_SECRET, DROPBOX_CLIENT_ID, or DROPBOX_CLIENT_SECRET directly in its request path.
The Next.js app generates the rclone config using src/lib/rclone/core/config-templates.ts and sends that config to Fly per request.
So the main app envs are the primary runtime source today, and the Fly secrets are currently environment-parity/config-surface inventory rather than the main execution dependency.

Local Inventory

No local .env.local, .env, or .env.development.local file exists in the clean Phase 5 worktree, so local provider values were not inventoried from disk.

Local still needs its own provider apps and credentials configured separately from dev and prod.

External Work Still Required

Create separate provider apps for:

local.
dev.
prod.

Then update:

local .env.local.
Vercel project stratofusion-dev.
Vercel project stratofusion-prod.
Fly app stratofusion-rclone-dev.
Fly app stratofusion-rclone-prod.

Recommended Follow-Up

Create new Google, OneDrive, and Dropbox apps for local/dev/prod.
Replace shared dev/prod provider credentials in Vercel.
Replace shared dev/prod provider credentials in Fly.
Test provider auth flows independently in local, dev, and prod.

Detailed runbook:

public/docs/OAUTH_PROVIDER_UPDATE_RUNBOOK_2026-03-19.md.