From 9dcc082920372d43afef288ad03445d3325aaae7 Mon Sep 17 00:00:00 2001
From: Bohan Jiang <52446949+Bohan-J@users.noreply.github.com>
Date: Thu, 23 Apr 2026 01:51:59 +0800
Subject: [PATCH] docs(handler): note that GetConfig is public-only and what
 may be returned (#1538)

Adds a doc comment on GetConfig spelling out that the endpoint is mounted on
the unauthenticated route group (so the login page can fetch GoogleClientID /
AllowSignup before the user is signed in) and that only instance-level public
fields may be added. Prevents accidentally returning user- or tenant-scoped
data from this handler in the future.
---
 server/internal/handler/config.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server/internal/handler/config.go b/server/internal/handler/config.go
index 9971164b70..3b330e21c7 100644
--- a/server/internal/handler/config.go
+++ b/server/internal/handler/config.go
@@ -22,6 +22,10 @@ type AppConfig struct {
 	PosthogHost string `json:"posthog_host"`
 }
 
+// GetConfig is mounted on the public (unauthenticated) route group because
+// the web app calls it before login to decide whether to render the Google
+// sign-in button and signup UI. Only add fields here that are safe to expose
+// to anonymous callers — never user- or tenant-scoped data.
 func (h *Handler) GetConfig(w http.ResponseWriter, r *http.Request) {
 	config := AppConfig{
 		AllowSignup:    os.Getenv("ALLOW_SIGNUP") != "false",