added email

.gitignore

@@ -1,4 +1,7 @@
+# Secrets: any .env at any depth, plus .env.local / .env.production etc. Templates stay tracked.
 .env
+.env.*
+!.env.example
 node_modules/
 dist/
 .venv/

backend/app/config.py

@@ -1,10 +1,16 @@
 from functools import lru_cache
+from pathlib import Path
 
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
+# One .env at the repo root serves every way of running the API; a backend/.env (or the
+# working directory's .env) overrides it. Real environment variables beat both.
+_ROOT_ENV = Path(__file__).resolve().parents[2] / ".env"
+
+
 class Settings(BaseSettings):
-    model_config = SettingsConfigDict(env_file=".env", extra="ignore")
+    model_config = SettingsConfigDict(env_file=(_ROOT_ENV, ".env"), extra="ignore")
 
     env: str = "development"
     app_name: str = "Notestack"

frontend/.env.example

@@ -1,2 +0,0 @@
-VITE_API_URL=
-VITE_GOOGLE_CLIENT_ID=

frontend/src/pages/AuthPage.tsx

@@ -21,7 +21,9 @@ declare global {
   }
 }
 
-const GOOGLE_CLIENT_ID = import.meta.env.VITE_GOOGLE_CLIENT_ID as string | undefined;
+const GOOGLE_CLIENT_ID = (import.meta.env.VITE_GOOGLE_CLIENT_ID || import.meta.env.GOOGLE_CLIENT_ID) as
+  | string
+  | undefined;
 
 function GoogleButton({ onCredential }: { onCredential: (c: string) => void }) {
   const ref = useRef<HTMLDivElement>(null);
@@ -47,7 +49,7 @@ function GoogleButton({ onCredential }: { onCredential: (c: string) => void }) {
   }, [onCredential]);
 
   if (!GOOGLE_CLIENT_ID) {
-    return <p className="mono muted auth-hint">Set VITE_GOOGLE_CLIENT_ID to enable Google sign in.</p>;
+    return <p className="mono muted auth-hint">Set GOOGLE_CLIENT_ID in .env to enable Google sign in.</p>;
   }
   return <div ref={ref} className="google-btn" />;
 }

frontend/vite.config.ts

@@ -3,6 +3,10 @@ import react from "@vitejs/plugin-react";
 
 export default defineConfig({
   plugins: [react()],
+  // Read the shared root .env. Only these prefixes reach the browser; the Google client ID is
+  // public by design, so it can be shared with the backend under its plain name.
+  envDir: "..",
+  envPrefix: ["VITE_", "GOOGLE_CLIENT_ID"],
   server: {
     port: 5173,
     proxy: { "/api": process.env.VITE_API_PROXY ?? "http://localhost:8000" },

renderer/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "studio": "remotion studio src/index.ts",
-    "start": "tsx server/index.ts",
+    "start": "tsx --env-file-if-exists=../.env server/index.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {