Function replaceSecretPlaceholder

js/server_functions.js:29–45

* Replace `**SECRET_ABC**` placeholders with the value of `process.env.SECRET_ABC`. * * If `allowedSecrets` is given, only those secret names are restored and every * other placeholder is left untouched. Without it, all secrets are restored * (used by the CORS proxy, which only runs on the trust

(input, allowedSecrets)

 * @returns {string} The input with the allowed placeholders replaced.
 */
function replaceSecretPlaceholder (input, allowedSecrets) {
	if (global.config.cors === "allowAll") {
		if (input.includes("**SECRET_")) {
			Log.error("Replacing secrets doesn't work with CORS `allowAll`, you need to set `cors` to `disabled` or `allowWhitelist` in `config.js`");
		}
		return input;
	}
	return input.replaceAll(/\*\*(SECRET_[^*]+)\*\*/g, (placeholder, secretName) => {
		// Block replacing secrets that are not explicitly allowed.
		if (allowedSecrets && !allowedSecrets.has(secretName)) {
			return placeholder;
		}

		// Load the real value from the environment. Fallback to placeholder if missing.
		return process.env[secretName] || placeholder;
	});
}

/**
 * A method that forwards HTTP Get-methods to the internet to avoid CORS-errors.