Feat/security hardening

.env.example

@@ -1,3 +1,32 @@
-CLAUDE_API_KEY=YOUR_CLAUDE_API_KEY
+# API Keys - Anthropic/Claude
+ANTHROPIC_API_KEY=sk-ant-api03-XXXXX
+CLAUDE_API_KEY=sk-ant-api03-XXXXX
+
+# OAuth et Redirects
 REDIRECT_URL=https://localhost:3458/auth/callback
-SHOPIFY_API_KEY=YOUR_APP_CLIENT_ID
+
+# Configuration Shopify App
+SHOPIFY_API_KEY=your_shopify_api_key_here
+SHOPIFY_CLIENT_ID=your_shopify_client_id_here
+SHOPIFY_STORE_DOMAIN=your-store.myshopify.com
+SHOPIFY_API_SECRET=your_api_secret_here
+
+# Tokens d'accès Shopify
+SHOPIFY_STOREFRONT_ACCESS_TOKEN=your_storefront_token_here
+SHOPIFY_ACCESS_TOKEN=your_admin_access_token_here
+
+# Scopes
+SHOPIFY_SCOPES=customer_read_customers,customer_read_orders,customer_read_store_credit_account_transactions,customer_read_store_credit_accounts,unauthenticated_read_product_listings
+SHOPIFY_CHAT_BUBBLE_ID=your_chat_bubble_extension_id
+
+# CORS - liste des origines autorisées (séparées par des virgules)
+# Laisser vide en dev (avec NODE_ENV=development) pour autoriser toutes les origines
+# En production, doit être configuré — sinon toutes les requêtes CORS sont bloquées
+ALLOWED_ORIGINS=https://your-store.myshopify.com
+
+# Logging verbeux — mettre à true pour activer les logs de débogage (false en production)
+DEBUG=false
+
+# Agent conversation limits
+MAX_AGENT_TURNS=5
+AGENT_SESSION_TIMEOUT_MS=30000

.github/workflows/fly-deploy.yml

@@ -0,0 +1,18 @@
+# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/
+
+name: Fly Deploy
+on:
+  push:
+    branches:
+      - main
+jobs:
+  deploy:
+    name: Deploy app
+    runs-on: ubuntu-latest
+    concurrency: deploy-group    # optional: ensure only one action runs at a time
+    steps:
+      - uses: actions/checkout@v4
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+      - run: flyctl deploy --remote-only
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

.gitignore

@@ -21,6 +21,9 @@ database.sqlite
 
 /extensions/*/dist
 
+# Generated reports
+/reports
+
 # Ignore shopify files created during app dev
 .shopify/*
 .shopify.lock

.vscode/mcp.json

@@ -0,0 +1,14 @@
+{
+	"servers": {
+		"my-mcp-server-b50f43c8": {
+			"type": "stdio",
+			"command": "npx",
+			"args": [
+				"@shopify/dev-mcp@latest",
+				"-s",
+				"project"
+			]
+		}
+	},
+	"inputs": []
+}

Dockerfile

@@ -1,7 +1,7 @@
 FROM node:18-alpine
 RUN apk add --no-cache openssl
 
-EXPOSE 3000
+EXPOSE 8080
 
 WORKDIR /app