Where do credentials end and configuration begin in your env file?

Welcome to No Compromises. A peek into the mind of two old web devs who have seen some things. This is Joel.

And this is Aaron.

Aaron, thanks for joining me here. I would like to discuss a recent PR in public and just have a chance to debate it a little bit more.

Because I seem to recall in a code review, I think I was reviewing your pull request, and I didn't really care. Like I didn't think, "Oh, this is terrible."

But I'm like, "Why did you do this?" And I made an offhand comment, and you're like, "Yeah, I disagree." I'm like, "You know what?

That'll be a good podcast topic." So here we are.

Okay.

So the scenario to set up what I had observed in the PR that I was commenting on was that you had added a bunch of values to our phpunit.xml file.

And these were keys that are also specified in the .env.example file, right? And so, it doesn't matter what they're for,

but they're for talking to an external service.

Yeah. Well, and before you go on too far, let's make sure when we say it doesn't matter what they're for.

The .env locally is filled up of two different things, right? The .env file. It's filled up of workflow control and credentials.

Okay.

So workflow control, I mean, things like is this enabled or is it not enabled?

Oh, sure.

Are we in debug mode? What database do we even... Like, what connection do we pick? Not the credentials, but what connection?

So it's all workflow. And then there's a second reason for it, which is credentials. Like API keys, passwords, things like that.

Yeah.

So, I just want to make sure that we bring those up because I think that might be the core of some of the things here too.

Oh, okay. All right, I'm prepared to be wrong about this, but... So these were credentials, right? These were things that you would use

to talk to another third-party or some other external system. And the ones you had added were actually things I had coded in a previous PR,

and I did not add them to the phpunit.xml. But then I believe what happened is you were working on this code, your tests were passing,

then you ran the whole suite, like a good developer, and some tests failed related to these keys that I had done in the previous PR.

And you're like, "Ah, Joel, blah blah blah," and then you added this to the phpunit.xml, and then your tests passed, and you moved on. Is that?

Yep.

Okay. And my contention was like, "Aaron, whenever somebody adds something to their projects, .env example,

it is your responsibility as a developer to copy that into your .env," right? Like that's part of-

Absolutely.

You agree with that?

Yep, absolutely.

Okay. Good, then I'm right.

No, we didn't go all the way through.

I'll keep going. All right, so defend yourself and explain it to me because I maybe see where you're going, but-

"Okay. Defend yourself."

Let me say this. If you had copied that .env example to your .env, your tests would have passed. Correct?

Yeah, your tests in my suite would have passed if I copied the .env.example files or line over that I honestly forgot. Did not notice.

Okay.

Correct.

All right, so-

But now I'm going to take it over now here because I'm glad I didn't.

I'm glad I didn't do that because that is the reason I still agree with what I did. And the reason is because-

Of course you do.

Well, yeah, because we talk about... remember it was credentials.

Yes.

So, when we work with Stripe, we put in something in our phpunit.xml. We're like, "Stripe key do not use."

Right.

So we know that there's a key in there and it hits. I don't remember what was in your .env.example, but maybe it was like, "Do not use,"

or maybe it was like some credentials that would have worked for yours, or whatever. Well, I don't know what they were, but even if I had copied them over,

it would have probably hidden the fact that I wanted to at least zero out the API key credential or something like that.

And if there wasn't an API key or credential, then at least the hostname. Because I want to make sure my tests never accidentally use my .env locally

to load up my test development .environment and hit things third-party.

Sure.

So, while I should have copied over to .env.example, the fact that I didn't showed me that there was tests that would hit those. Whether or not they

would actually call out I don't know, but they were dying because they were missing those keys. So I put them there to basically say that I wanted to stop this.

Now, when I think about it, I think I did it wrong in another way. And I'll tell you how so that you can feel happy here.

Thank you.

There was like four or five keys. What I should have done-

I'm looking at it, there are seven.

Whatever. So, what I should have done is copy over from the .env.example from my local copy when I first noticed it.

That's what I should have done. Then I should have added in one key to make sure that they could never hit the external world in the phpunit.xml

All right. So, I'm going to push back a little bit. Because I agree in principle with everything you said, but I think it might not completely have

been the way you're describing it. Because there was, let's call the service... Let's say Stripe because Stripe is something people know about.

So, I had a key in there called Stripe Host that was some invalid URL blah blah blah. Stripe isn't really a great example because this-

But it doesn't matter. Third party, like insurance company. We're hitting insurance company, and you had a URL for insurance company API, right?

Yeah. Okay, so all of the keys in here, the ones that you added, that I did not choose to put in the phpunit.xml, were not credentials.

They were like port numbers, and they were like configuration. Like, this is the location ID It's going to look up.

Yeah, absolutely.

But you still feel like that is something that-

No, those are workflows. Those are configuration or workflow. That's what I'm saying. I would have copied over

all seven from that example to my .env.

Okay.

Then I should put one .env in PHPunit.XML, finding that host and making sure was something crazy. Because remember, we might use this locally,

and so locally the .env we might actually make a real host. So, if we don't put something in phpunit.XML to make it a fake host and one of our tests runs,

it'll hit that real host.

Okay. I did have the hostname in there already as fake, so I was right.

Right. But what if I wanted to use it in real life locally in my-

Okay.

That's what I keep saying. It's like when I configure those properly, it would be working for my development environment,

and I run my tests. And if a test was configured to hit that, it would hit that.

Well, but just to clarify. I'm saying I did put the one entry in phpunit.xml that talks, that's the hostname.

All the other things were configuration, the host name was already there.

Oh, did you? Oh, I missed that then. You should have pushed back harder then.

Okay. No, that's fair. But I think this... I'm going to take away from this. I don't care if anybody else is benefiting from this right now,

but I never really thought about the distinction that you drew between configuration/workflow and credentials.

And credentials would include things like the hostname. Like, the way you talk to the outside world is-

Yeah.

Yeah, okay. All right, I feel like we both had good points, but I'm going to say I won.

I'm definitely right. Cool.

You know, it's funny that like things go in sort of cycles, you know. You notice that with trends,

clothes, design, interior design, houses, all that kind of stuff, right?

Mm-hmm (affirmative).

And I never really thought about the cycles of entertainment because it always just seemed like our entertainment sort of moved forward.

But then I started thinking like, "No, it does a cycle too." And something hit me the other day that is just actually hilarious, and I don't know if anyone else

finds it hilarious. But I'm just going to say the statement, and then you can agree or disagree. YouTube music is just basically MTV again.

Okay. Yeah.

Because all it is is... I've seen this now, people in a generation different than mine, younger, will play YouTube music either in their other

screen or even like minimize. And it's a music video with the music. I'm like, you're basically watching MTV again. And by the way, don't get me started on

just being a guy who is stuck in the past thinking about data bandwidth and all that kind of stuff. You just want the audio, so why are you sending the video?

Ah. But anyway, yeah, just MTV again. It's interesting how those things circle.

So, as we kind of learned in this podcast, you can do something right and

wrong all at the same time. It's sort of opinion, but is it opinion? I don't really know, but a lot of that stuff will come out during a code review.

Code review, that's something we could help your team with. If you'd like Aaron and I to review your code, head over to masteringlaravel.io/codereview.