From 9637fcc79786f08cc4f5ff3fffa01b5d859f6ca2 Mon Sep 17 00:00:00 2001
From: Javier Blanco <javierblancodetorres@gmail.com>
Date: Thu, 30 Apr 2026 10:58:00 +0700
Subject: [PATCH] protect secret array

---
 deploy.php | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/deploy.php b/deploy.php
index 98a5a54..b00e970 100644
--- a/deploy.php
+++ b/deploy.php
@@ -1,7 +1,8 @@
 <?php
 declare(strict_types=1);
 
-const SECRET_FILE = '/home/javi/.deploy-secret.php';
+const CONFIG_FILE = '/home/javi/.deploy-secret.php';
+const PROJECT_KEY = 'hello-world';
 const ALLOWED_BRANCH = 'master';
 const REPO_PATH = '/home/javi/hello-world.ai1.ovh';
 const GIT_BIN = '/usr/bin/git';
@@ -28,15 +29,16 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     respond(405, 'Method Not Allowed');
 }
 
-if (!file_exists(SECRET_FILE)) {
-    log_line('ERROR: No existe SECRET_FILE: ' . SECRET_FILE);
-    respond(500, 'Secret file not found');
+$config = require CONFIG_FILE;
+if (!is_array($config) || !isset($config[PROJECT_KEY])) {
+    log_line('ERROR: Secret no configurado para PROJECT_KEY=' . PROJECT_KEY);
+    respond(500, 'Project secret not configured');
 }
 
-$secret = require SECRET_FILE;
-if (!$secret || !is_string($secret)) {
-    log_line('ERROR: SECRET_FILE inválido');
-    respond(500, 'Secret file error');
+$secret = $config[PROJECT_KEY];
+if (!is_string($secret) || $secret === '') {
+    log_line('ERROR: Secret inválido para PROJECT_KEY=' . PROJECT_KEY);
+    respond(500, 'Invalid project secret');
 }
 
 $contentType = $_SERVER['CONTENT_TYPE'] ?? '';
@@ -94,7 +96,6 @@ if (!is_dir(REPO_PATH)) {
 }
 
 $commands = [
-    'cd ' . escapeshellarg(REPO_PATH) . ' && ' . GIT_BIN . ' rev-parse --is-inside-work-tree 2>&1',
     'cd ' . escapeshellarg(REPO_PATH) . ' && ' . GIT_BIN . ' fetch origin 2>&1',
     'cd ' . escapeshellarg(REPO_PATH) . ' && ' . GIT_BIN . ' checkout ' . escapeshellarg(ALLOWED_BRANCH) . ' 2>&1',
     'cd ' . escapeshellarg(REPO_PATH) . ' && ' . GIT_BIN . ' pull origin ' . escapeshellarg(ALLOWED_BRANCH) . ' 2>&1',
@@ -118,12 +119,7 @@ foreach ($commands as $cmd) {
     }
 }
 
-$after = $data['after'] ?? '';
-$pusher = $data['pusher']['login'] ?? ($data['sender']['login'] ?? 'unknown');
-
-$logBlock = "Webhook OK | event=push | ref={$ref} | after={$after} | pusher={$pusher}\n" .
-            implode("\n", $outputAll) . "\n---";
-log_line($logBlock);
+log_line("PROJECT_KEY=" . PROJECT_KEY . "\n" . implode("\n", $outputAll) . "\n---");
 
 if ($returnCode !== 0) {
     respond(500, 'Deploy failed. Revisa deploy.log');