From da5a36e8add2544edb9d92c2692d1a2003ced412 Mon Sep 17 00:00:00 2001
From: Timmy <loyangchun@gmail.com>
Date: Mon, 20 Apr 2026 09:17:24 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E7=A7=BB=E9=99=A4=20hard-coded=20F?=
 =?UTF-8?q?UNCTION=5FTOKEN=EF=BC=8C=E6=94=B9=E5=BE=9E=20env=20=E8=AE=80?=
 =?UTF-8?q?=E5=8F=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pokemon_location_fetcher.py：DEFAULT_URL/TOKEN 改走 os.getenv，並補 load_dotenv() 讓 fetch_and_upload.sh 能從 .env 取值
- run_pokemon_radar_api.sh：POKER_* 改為可由環境覆蓋（實務上未被 API 使用，保留結構）
- pyproject.toml：補宣告 python-dotenv（專案已使用但原本未列）

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 pokemon_location_fetcher.py | 8 ++++++--
 pyproject.toml              | 1 +
 run_pokemon_radar_api.sh    | 7 ++++---
 uv.lock                     | 4 +++-
 4 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/pokemon_location_fetcher.py b/pokemon_location_fetcher.py
index 7c558bf..7fd154d 100644
--- a/pokemon_location_fetcher.py
+++ b/pokemon_location_fetcher.py
@@ -9,10 +9,14 @@ from datetime import datetime, timezone
 from typing import Optional, List, Dict, Any
 from zoneinfo import ZoneInfo
 
+from dotenv import load_dotenv
+
+load_dotenv()
+
 TAIPEI_TZ = ZoneInfo("Asia/Taipei")
 
-DEFAULT_URL = "http://192.168.42.124:13000/function"
-DEFAULT_TOKEN = "6R0W53R135510"
+DEFAULT_URL = os.getenv("FUNCTION_URL", "http://192.168.42.124:13000/function")
+DEFAULT_TOKEN = os.getenv("FUNCTION_TOKEN", "")
 
 CSV_FIELDS = [
     "id",
diff --git a/pyproject.toml b/pyproject.toml
index 1e2f59b..de55026 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,5 +10,6 @@ dependencies = [
     "redis>=7.1.0",
     "loguru>=0.7.3",
     "rich>=14.2.0",
+    "python-dotenv>=1.0.0",
 ]
 
diff --git a/run_pokemon_radar_api.sh b/run_pokemon_radar_api.sh
index a9047d8..53e7336 100755
--- a/run_pokemon_radar_api.sh
+++ b/run_pokemon_radar_api.sh
@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 cd /opt/pokemon-radar-api
 
-export POKER_URL="http://192.168.42.124:13000/function"
-export POKER_TOKEN="6R0W53R135510"
-export POKER_SCRIPT="twpk_radar.mjs"
+# POKER_* 目前 unused（API 只讀 REDIS_*）；保留結構，實際值放 .env
+export POKER_URL="${POKER_URL:-}"
+export POKER_TOKEN="${POKER_TOKEN:-}"
+export POKER_SCRIPT="${POKER_SCRIPT:-twpk_radar.mjs}"
 
 # uv run uvicorn pokemon_radar_api:app --host 0.0.0.0 --port 8008
 
diff --git a/uv.lock b/uv.lock
index f44ab0a..669a508 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 2
+revision = 3
 requires-python = ">=3.10"
 
 [[package]]
@@ -321,6 +321,7 @@ dependencies = [
     { name = "fastapi" },
     { name = "httpx" },
     { name = "loguru" },
+    { name = "python-dotenv" },
     { name = "redis" },
     { name = "requests" },
     { name = "rich" },
@@ -332,6 +333,7 @@ requires-dist = [
     { name = "fastapi" },
     { name = "httpx", specifier = ">=0.28.1" },
     { name = "loguru", specifier = ">=0.7.3" },
+    { name = "python-dotenv", specifier = ">=1.0.0" },
     { name = "redis", specifier = ">=7.1.0" },
     { name = "requests" },
     { name = "rich", specifier = ">=14.2.0" },