add comment re api key and github secrets

cioos-siooc · Apr 3, 2024 · 69a31dc · 69a31dc
1 parent 95a3fd1
commit 69a31dc
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/firebase.js b/src/firebase.js
@@ -10,6 +10,13 @@ const productionDB = "https://cioos-metadata-form.firebaseio.com";
 const devDB = "https://cioos-metadata-form-dev.firebaseio.com";
 
 const config = {
+  // see https://console.cloud.google.com/apis/credentials?project=cioos-metadata-form
+  // and https://console.cloud.google.com/apis/credentials?project=cioos-metadata-form-dev
+  // for api key location which is then stored in a github secret and added to several
+  // github actions to support testing and deployment.
+  // see https://firebase.google.com/docs/projects/api-keys for a discussion of why we 
+  // don't need to restrict api keys for firebase but might in some situations.
+  // To prevent the future foot gun, we are restricting the key now.
   apiKey: process.env.REACT_APP_GOOGLE_CLOUD_API_KEY,
   authDomain: "cioos-metadata-form.firebaseapp.com",
   databaseURL: