fix: implement dynamic environment variable management for Firebase Functions deployment and enhance server configuration loading

Author: danieldanielecki

.gitignore

@@ -43,4 +43,5 @@ testem.log
 .DS_Store
 Thumbs.db
 .env
+functions/.env
 src/assets/env.js

functions/README.md

@@ -3,3 +3,11 @@
 This folder is a minimal Firebase Functions wrapper used during deploys.
 
 CI generates `functions/index.js` from the SSR server bundle and Firebase deploys this folder as the Functions source.
+
+## Mail trigger (`contactFormFunction`)
+
+`src/server.ts` loads **`functions/.env`** (next to `index.js`) first, then the repo root `.env`, via `dotenv`. GitHub Actions runs **`scripts/write-functions-env.mjs`** before `firebase deploy`, which writes `functions/.env` from the workflow’s **`MAIL_*`** and **`FIRESTORE_COLLECTION_MESSAGES`** secrets so the deployed bundle sees the same values at runtime.
+
+**Manual override (optional):** You can still set variables on the function in [Cloud Functions](https://console.cloud.google.com/functions) → **Runtime environment variables**, or use [Secret Manager](https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets).
+
+`functions/.env` is gitignored; do not commit it.

package.json

@@ -16,8 +16,8 @@
     "build:ssr": "pnpm run build && ng run ditectrev:server",
     "build:prerender": "ng run ditectrev:prerender:production",
     "build:ssr:production": "pnpm run prepare:browser-env && ng build --configuration production && ng run ditectrev:server:production",
-    "build-and-deploy:ssr:staging:firebase": "npm run build:ssr && npm run root:starting:index:firebase && firebase use \"$CI_ENVIRONMENT_SLUG\" --token \"$FIREBASE_DEPLOY_KEY\" && firebase deploy --force --token \"$FIREBASE_DEPLOY_KEY\"",
-    "build-and-deploy:ssr:production:firebase": "npm run build:ssr:production && npm run root:starting:index:firebase && firebase use \"$CI_ENVIRONMENT_SLUG\" --token \"$FIREBASE_DEPLOY_KEY\" && firebase deploy --force --token \"$FIREBASE_DEPLOY_KEY\"",
+    "build-and-deploy:ssr:staging:firebase": "npm run build:ssr && npm run root:starting:index:firebase && node scripts/write-functions-env.mjs && firebase use \"$CI_ENVIRONMENT_SLUG\" --token \"$FIREBASE_DEPLOY_KEY\" && firebase deploy --force --token \"$FIREBASE_DEPLOY_KEY\"",
+    "build-and-deploy:ssr:production:firebase": "npm run build:ssr:production && npm run root:starting:index:firebase && node scripts/write-functions-env.mjs && firebase use \"$CI_ENVIRONMENT_SLUG\" --token \"$FIREBASE_DEPLOY_KEY\" && firebase deploy --force --token \"$FIREBASE_DEPLOY_KEY\"",
     "test": "ng test --no-watch",
     "lint": "ng lint",
     "e2e": "start-server-and-test start:e2e http://127.0.0.1:4311 \"playwright test\"",

scripts/write-functions-env.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+/**
+ * Writes `functions/.env` from the current process environment so `firebase deploy` uploads it
+ * next to `index.js`. `src/server.ts` loads it via `loadEnv({ path: join(__dirname, '.env') })`.
+ *
+ * Intended for GitHub Actions (`GITHUB_ACTIONS=true`). Local deploy: set `WRITE_FUNCTIONS_ENV=1`
+ * or rely on Cloud Console env / root `.env` for local runs.
+ */
+import { writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const rootDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const outPath = join(rootDir, 'functions', '.env');
+
+/** Keys the SSR bundle reads at runtime on Cloud Functions (keep in sync with deploy workflow env). */
+const KEYS = [
+  'MAIL_HOST',
+  'MAIL_PORT',
+  'MAIL_ACCOUNT',
+  'MAIL_PASSWORD',
+  'FIRESTORE_COLLECTION_MESSAGES',
+];
+
+function shouldRun() {
+  return process.env.GITHUB_ACTIONS === 'true' || process.env.WRITE_FUNCTIONS_ENV === '1';
+}
+
+function escapeValue(v) {
+  return String(v)
+    .replace(/\\/g, '\\\\')
+    .replace(/\r?\n/g, '\\n')
+    .replace(/"/g, '\\"');
+}
+
+function main() {
+  if (!shouldRun()) {
+    console.log('write-functions-env: skip (not CI; export WRITE_FUNCTIONS_ENV=1 to force)');
+    return;
+  }
+
+  const lines = [];
+  for (const k of KEYS) {
+    const v = process.env[k];
+    if (v === undefined || v === '') continue;
+    lines.push(`${k}="${escapeValue(v)}"`);
+  }
+
+  if (lines.length === 0) {
+    console.warn('write-functions-env: no matching env keys set; not writing functions/.env');
+    return;
+  }
+
+  writeFileSync(outPath, `${lines.join('\n')}\n`, 'utf8');
+  console.log(`write-functions-env: wrote ${lines.length} entries to functions/.env`);
+}
+
+main();

src/server.ts

@@ -2,7 +2,7 @@
  * Unified SSR server entrypoint used both locally (`node dist/ditectrev-server/main.js`)
  * and in Firebase Functions (`functions/index.js` generated from this bundle).
  */
-import 'dotenv/config';
+import { config as loadEnv } from 'dotenv';
 import 'zone.js/node';
 import * as admin from 'firebase-admin';
 import * as express from 'express';
@@ -15,6 +15,11 @@ import { existsSync, readFileSync } from 'fs';
 import helmet from 'helmet';
 import { AppServerModule } from './app/app.server.module';
 
+// CI writes `functions/.env` from GitHub secrets before `firebase deploy` (see `scripts/write-functions-env.mjs`).
+// Local dev: repo root `.env` (second line). Packaged `.env` is loaded first on Cloud Functions.
+loadEnv({ path: join(__dirname, '.env') });
+loadEnv({ path: join(process.cwd(), '.env') });
+
 export { AppServerModule } from './app/app.server.module';
 
 const app = express();