
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@mapsheet/import-client
Advanced tools
git clone git@github.com:getinfill/infill.git
cd infill
yarn install
yarn run vercel:init
cd firebase
yarn install
Specify ENCRYPTION_KEY and ENCRYPTION_IV in .env.local for local environment to work correctly. See [Secrets management](## Secrets management) for details.
Project is based on next.js, so easiest setup is to run it on vercel.
To build and run the server locally
yarn run build
yarn run start
"editor.formatOnSave": true"files.insertFinalNewline": truePeriodically pull development .env:
yarn vercel env pull
To rebuild all ReScript:
yarn rescript clean && yarn rescript build
App can be run on firebase emulators or on the staging database.
To run on emulators:
yarn dev
Firestore state will be preserved among runs in firebase/db. You can reset state by removal of the folder.
To use firebase staging database instead of emulators use the following command instead:
yarn dev:no-emulators
get-graphql-schema https://graphql.cherre.com/graphql/ -h "Authorization=Bearer <TOKEN>" -j --output graphql_schema.json
Install Cloud SQL Auth Proxy; Look up Connection name of the instance to connect here, on Overview tab of instance page.
Run proxy:
cloud_sql_proxy -instances=INSTANCE_CONNECTION_NAME=tcp:5432
Make sure you are not running local DBMS on same port. Then connect with SQL client to proxied local port:
psql "host=127.0.0.1 port=5432 sslmode=disable dbname=postgres user=postgres"
Integration tests for API runs over network, so all tests services should be started. Tests for core api
checks server https://infill-core-api.herokuapp.com, tests for next.js based api checks http://localhost:3000.
yarn run test:integration
Reason for doing this is Vercel's environment variables size limit, which is 4KB. https://github.com/vercel/vercel/discussions/5364
Place non-public tokens, keys, etc. in secretsPlain.js, following example in secretsPlain.js.example, then run
node scripts/encryptSecrets.js
to encrypt and write them in server/secretsEncrypted.js.
Key and IV (initialization vector) would be prompted for entry.
Key should be 32 character long, and IV should be 16 characters long. They can be easily generated in shell:
tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_`{|}~' </dev/urandom | head -c 16 ; echo
(Source: https://unix.stackexchange.com/a/230676)
Key and IV should be available on Vercel as ENCRYPTION_KEY and ENCRYPTION_IV secret environment variables in Vercel.
If these values are changed on Vercel, ALL FOLLOWING DEPLOYMENTS should have secrets encrypted with changed keys.
For now, Key and IV are universal across all environments.
Import secrets from server/secrets.js, e.g.:
[@bs.module "../../server/secrets"] [@bs.scope ("default")] external key: string = "key";
to use them in code.
Add production remote, this only needs to be done once:
git remote add production git@github.com:getinfill/infill-production.git
git fetch --all
git checkout production
git reset --hard origin/master
git push production production
or
git push production production --force
in case when patches were applied to master.
Reset to the current production branch, commit changes, switch to the new branch as usually. Then, push to the developement repository to have a preview deployment:
git push origin <branchName>
Once satisfied with changes, upgrade production branch and push it. Do not use production vercel/github for preview deployments, as they will work with production backend and data.
git checkout production
git merge <branchName>
git push production production
Now, when production is patched, rebase onto development branch to integrate changes to it
git checkout <branchName>
git rebase origin/master
git push origin <branchName> --force
Generate new migration file
yarn dev:firegate:generate <name>
Run migration in development
yarn dev:firegate:run --force <name>
Note that migrations on production and staging are triggered by any commit in main branches. (production and master)
For preview deployments migrations are executed only when PR is created.
FAQs
Import records into Mapsheet
The npm package @mapsheet/import-client receives a total of 60 weekly downloads. As such, @mapsheet/import-client popularity was classified as not popular.
We found that @mapsheet/import-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.