Use Rails credentials to store secrets

.gitattributes

@@ -0,0 +1 @@
+config/credentials.yml.enc diff=rails_credentials

Gemfile

@@ -22,7 +22,6 @@ end
 
 group :development, :test do
   gem 'byebug', '~> 11.0', platforms: [:mri, :mingw, :x64_mingw]
-  gem "dotenv-rails", '~> 2.7'
   gem 'rubocop', '~> 0.80.1', require: false
   gem 'rubocop-rails', '~> 2.5.0', require: false
 end

Gemfile.lock

@@ -97,10 +97,6 @@ GEM
       openssl-signature_algorithm (~> 1.0)
     crass (1.0.6)
     date (3.3.4)
-    dotenv (2.7.6)
-    dotenv-rails (2.7.6)
-      dotenv (= 2.7.6)
-      railties (>= 3.2)
     erubi (1.12.0)
     ffi (1.16.3)
     globalid (1.2.1)
@@ -277,7 +273,6 @@ DEPENDENCIES
   bundler-audit (~> 0.9.1)
   byebug (~> 11.0)
   capybara (~> 3.26)
-  dotenv-rails (~> 2.7)
   importmap-rails (~> 1.2)
   listen (~> 3.8)
   minitest-stub_any_instance (~> 1.0)

app/controllers/application_controller.rb

@@ -23,7 +23,7 @@ def current_user
   def relying_party
     @relying_party ||=
       WebAuthn::RelyingParty.new(
-        origin: ENV["WEBAUTHN_ORIGIN"],
+        origin: Rails.configuration.webauthn_origin,
         name: "WebAuthn Rails Demo App"
       )
   end

app/views/application/_rollbar_js.html.erb

@@ -1,6 +1,6 @@
 <script>
 var _rollbarConfig = {
-  accessToken: "<%= ENV['ROLLBAR_POST_CLIENT_ITEM_ACCESS_TOKEN'] %>",
+  accessToken: "<%= Rails.application.credentials.rollbar_post_client_item_access_token %>",
   captureUncaught: true,
   captureUnhandledRejections: true,
   payload: {

config/credentials.yml.enc

@@ -1 +1 @@
-kqrULqvSMTkOb3+WoLWQp+FDG8MpT34JbJ63Nxs/8WhtSyMq4qLa83ehibUuBEcEr26Qrus/RZMtEQVFtOZB4mUDSC0s0pddyYWPGo0Xjh0oapo5aRA1OTjjMtREkH99fZDUH4sYUClLwUkryTLlry2WdcGR61Q6aFuD36bOx3qgYjIwgOcGIJVlTdeCEbRvFX5yAW3dqrnPK8jBld2PxpEF1KGmQM8VcdN7Q45GpKdinfZ/lRLwlAMgRisUyORHSYSsegofBSlT6QFKqruPeBE8p/bTBtUXJeKvrSrtsnQxBOzOf4gphXUVDNTj+pS8l7AjOkNKI4dHKVvu8PbHVKngXwfDT8VE0av3EkpnQDhM4H4VnCFul1RfRUlRdb59EvBTnrMABt3rYYQfXRN2ITyLjTiCe/3M+CBB--XSY7HCWG2r8CNmvq--7jyZcRe1ipbUxzlR0pV5XQ==
+DFpjzqUQYr1EI503VX+ZgABwpJ4diOr0Ubzkd76GzH5e4SRl45xue2AY25ETpqv6hH+bIAlheggTwmDCM3qZy1793rOHjKuf5Lu1hNZIB7d24m+BSxoyoWFNurO2F2BTIDrWUZO8KN064w7GlMpMRECHSHvc8aJZyHR7JGIZ32o/Zf5KmFd9cRchWE9pejdjMJAUySYPJEsJe7knVl+x23eMTtWlg1B9HK0ZjPfCuWwZEtiQe04l5UM1tZzaIokC8IP5fwtHR4QgYRPrA8g244N/PETRuNOT1hAyVwqrvvaTWiyZdYY70Hh2uJ2E4Zn5SyuLs3vBkzOPNJUGCe29HMp5ule4O+jYieJvJ6i0o9L978pY1y4Fst+XSZ92k/3bKo3MF4778gf+AecgZbbXH/2LSco4TrLSF8qTfahW/wsJD449eYdvHVVPT3WxpdLgLPMmRNwG0F+nDN/RunQd+5102k5BO/VzaNnrR56ivpPgEAXlFd7eRUQow/kkiM0m97Tu0AaLeE6fHMQzDzfxBaRfjs2eQh/eB9SkLOEfTWAkl8P8NcIuQVh+cjnqcdqcmbdQErc+a5lhr2UZ1n4gS8PYkwq6CgMifslLGLPntm6ebx8PIvLQOaw226g=--V3U6uSlBXvLmxpwM--G4Vit/cYx2o1hIf2KPnlWg==

config/environments/development.rb

@@ -68,4 +68,6 @@
 
   # Uncomment if you wish to allow Action Cable access from any origin.
   # config.action_cable.disable_request_forgery_protection = true
+
+  config.webauthn_origin = 'http://localhost:3000'
 end

config/environments/production.rb

@@ -83,5 +83,7 @@
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
 
-  config.middleware.use(Rack::HostRedirect, "webauthn.herokuapp.com" => URI(ENV["WEBAUTHN_ORIGIN"]).host)
+  config.webauthn_origin = 'https://webauthn.cedarcode.com'
+
+  config.middleware.use(Rack::HostRedirect, "webauthn.herokuapp.com" => URI(config.webauthn_origin).host)
 end

config/environments/test.rb

@@ -53,4 +53,6 @@
 
   # Annotate rendered view with file names.
   # config.action_view.annotate_rendered_view_with_filenames = true
+
+  config.webauthn_origin = 'http://localhost:3030'
 end

config/initializers/rollbar.rb

@@ -4,7 +4,7 @@
   # Without configuration, Rollbar is enabled in all environments.
   # To disable in specific environments, set config.enabled=false.
 
-  config.access_token = ENV['ROLLBAR_POST_SERVER_ITEM_ACCESS_TOKEN']
+  config.access_token = Rails.application.credentials.rollbar_post_server_item_access_token
 
   # Here we'll disable in 'test':
   if Rails.env.test? || Rails.env.development?
@@ -69,5 +69,5 @@
   # environment variable like this: `ROLLBAR_ENV=staging`. This is a recommended
   # setup for Heroku. See:
   # https://devcenter.heroku.com/articles/deploying-to-a-custom-rails-environment
-  config.environment = ENV['ROLLBAR_ENV'].presence || Rails.env
+  config.environment = Rails.application.credentials.rollbar_env.presence || Rails.env
 end

test/application_system_test_case.rb

@@ -6,7 +6,7 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
   driven_by :selenium, using: (ENV["TEST_BROWSER"] || :chrome).to_sym, screen_size: [1400, 1400]
 
   setup do
-    Capybara.app_host = ENV['WEBAUTHN_ORIGIN']
+    Capybara.app_host = Rails.configuration.webauthn_origin
     Capybara.server_host = "localhost"
     Capybara.server_port = 3030
     Capybara.default_max_wait_time = 20

test/controllers/registrations_controller_test.rb

@@ -38,7 +38,7 @@ class RegistrationsControllerTest < ActionDispatch::IntegrationTest
 
     public_key_credential =
       WebAuthn::FakeClient
-      .new(ENV["WEBAUTHN_ORIGIN"])
+      .new(Rails.configuration.webauthn_origin)
       .create(challenge: challenge, user_verified: true)
 
     webauthn_credential = WebAuthn::Credential.from_create(public_key_credential)

test/system/add_credential_test.rb

@@ -5,7 +5,7 @@
 
 class AddCredentialTest < ApplicationSystemTestCase
   test "add credentials" do
-    fake_origin = ENV['WEBAUTHN_ORIGIN']
+    fake_origin = Rails.configuration.webauthn_origin
     fake_client = WebAuthn::FakeClient.new(fake_origin, encoding: false)
     fixed_challenge = SecureRandom.random_bytes(32)
 

test/system/registration_test.rb

@@ -5,7 +5,7 @@
 
 class RegistrationTest < ApplicationSystemTestCase
   test "register user" do
-    fake_origin = ENV['WEBAUTHN_ORIGIN']
+    fake_origin = Rails.configuration.webauthn_origin
     fake_client = WebAuthn::FakeClient.new(fake_origin, encoding: false)
     fixed_challenge = SecureRandom.random_bytes(32)
 

test/system/sign_in_test.rb

@@ -5,7 +5,7 @@
 
 class SignInTest < ApplicationSystemTestCase
   test "register and then sign in" do
-    fake_origin = ENV['WEBAUTHN_ORIGIN']
+    fake_origin = Rails.configuration.webauthn_origin
     fake_client = WebAuthn::FakeClient.new(fake_origin, encoding: false)
     fixed_challenge = SecureRandom.random_bytes(32)