{"id":"699f7bfce0b9ae881d3e409f","title":"2026 02 25 Issue 146","path":"how-to/committee/release-notes/2026-02-25-issue-146","contentMarkdown":"# 25-Feb-2026 — secure and harden Environment Setup and Backup & Restore [ref #146](https://github.com/nbarrett/ngx-ramblers/issues/146)\n\n## [build 499](https://github.com/nbarrett/ngx-ramblers/actions/runs/22418830262) — [commit 8ea4a2e](https://github.com/nbarrett/ngx-ramblers/commit/8ea4a2efc262baadd2710c339b333cdc869b463f)\n\n_____\n\n## Platform admin gating\n- Backup & Restore and Environment Setup now check `PLATFORM_ADMIN_ENABLED` on\ninit and display a consistent \"Not Available\" alert (icon + bold title) when\nthe flag is absent, matching the alert style used across the admin section\n- Backup & Restore skips loading environments, backups, sessions and the\nWebSocket connection when the flag is absent, avoiding unnecessary API calls\n- Added the ngx-ramblers environment entry to the EnvironmentsConfig DB document\nwith `PLATFORM_ADMIN_ENABLED=true` in its secrets block so the flag survives\nfuture deploys via `loadSecretsForEnvironmentFromDatabase`\n## Setup API-key authentication\n- Environment Setup routes now accept requests authenticated by either a valid\nadmin JWT (member/content/file/walk/social/treasury/finance admin roles) or\nthe `x-setup-api-key` header, enabling logged-in admins to use the page\nwithout a separate setup key\n- `isAdminRequest()` added to server routes — verifies the Bearer token with\n`jsonwebtoken` and checks any admin-role claim before granting access\n- `EnvironmentSetupService` gains a `setupApiKey` field and an `opts` getter;\nall HTTP calls now forward the key in `x-setup-api-key` when present\n- Component gains `requiresApiKey` / `setupApiKeyValue` / `setupApiKeyEntered`\nstate and a `submitSetupApiKey()` method so the UI can prompt for the key\nwhen the server signals it is required (`status.requiresApiKey`)\n## Defaults loading improvements\n- `loadDefaults()` now loads system config first (normal session auth, never\n401) and then loads environment defaults separately so a 401 on the defaults\nendpoint does not prevent the Ramblers API key from being pre-filled\n- `EnvironmentDefaults` model extended with `ramblers.apiKey` field\n- `/defaults` endpoint populates `ramblers.apiKey` from\n`national.walksManager.apiKey` in the system config so the Ramblers API key\nis offered as a default without manual entry\n## Mongoose reconnection fix\n- `closeMigrationConnection()` calls `mongoose.disconnect()` after running\nmigrations, which left subsequent operations (`seedBrevoTemplatesFromLocal` ->\n`configuredBrevo` -> `config.findOne`) failing with \"Client must be connected\nbefore running operations\"\n- Added `ensureMongoConnection()` after `initialiseDatabase()` returns so\nmongoose reconnects to the main database before Brevo template population runs\n## GitHub Secrets panel (Environment Settings → GitHub Secrets sub-tab)\n- New `EnvironmentGitHubSecrets` standalone component shows the GitHub\n`CONFIGS_JSON` secret staleness relative to the database, with per-environment\ndiff detail (new / removed / changed fields) and a one-click Push button\n- `GET /api/environment-setup/github/status` compares DB environments against\nthe live `CONFIGS_JSON` value; matches by name first then appName fallback to\navoid cross-matching where multiple DB documents share the same fly.io app\n- `POST /api/environment-setup/github/push` pushes DB → GitHub directly without\ntouching configs.json; after a successful push, `process.env.CONFIGS_JSON` is\nupdated in-process so subsequent status checks reflect what was pushed\n- On first status check locally (no `CONFIGS_JSON` env var), the value is\ninitialised from the DB — same runtime behaviour as production where fly.io\ninjects it at startup — eliminating configs.json as a third piece of state\n- `transformDatabaseToDeployConfig` now filters out orphan DB environment\ndocuments (no flyio config), deduplicates by appName (first occurrence wins),\nand is exported for reuse in the status route\n- `EnvironmentSettingsSubTab.GITHUB` added; heading uses `with-vendor-logo`\nstyle with the GitHub FA brand icon; `.thumbnail-heading.with-vendor-logo`\ntop offset corrected to -34px in frames.sass\n## Dockerfile: GitHub CLI\n- `gh` CLI installed in Docker image so the GitHub Secrets panel can fetch\nsecret metadata and push `CONFIGS_JSON` from the deployed environment\n- `GH_TOKEN` and `PLATFORM_ADMIN_ENABLED=true` set as fly.io secrets on the\nngx-ramblers (staging) app to authenticate `gh` and enable the admin pages","contentHtml":"

25-Feb-2026 — secure and harden Environment Setup and Backup & Restore ref #146

\n

build 499 — commit 8ea4a2e

\n
\n

Platform admin gating

\n\n

Setup API-key authentication

\n\n

Defaults loading improvements

\n\n
    \n
  1. and then loads environment defaults separately so a 401 on the defaults\nendpoint does not prevent the Ramblers API key from being pre-filled
    2. \n
\n\n

Mongoose reconnection fix

\n\n

GitHub Secrets panel (Environment Settings → GitHub Secrets sub-tab)

\n\n

Dockerfile: GitHub CLI

\n\n"}