Handover docs plus safe fixes for known risks

.env.example

@@ -1,5 +1,6 @@
 APP_ENV=local
-APP_KEY=base64:ilyL17PxJTnZXqNBVr+P36ARu9NF7HgqJ87ciGWvo5E=
+# Generate with: php artisan key:generate
+APP_KEY=
 APP_DEBUG=false
 APP_TIMEZONE=UTC
 APP_URL=http://localhost
@@ -16,10 +17,24 @@ BCRYPT_ROUNDS=12
 
 DB_CONNECTION=sqlite
 DB_DATABASE=database/database.sqlite
+# Deployed environments use mysql and need the following instead:
+# DB_CONNECTION=mysql
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_USERNAME=
+# DB_PASSWORD=
+# Used only by the opt-in mysql_testing connection in phpunit.xml
+# DB_DATABASE_TESTING=
+
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_PASSWORD=
 
 CACHE_STORE=array
 SESSION_DRIVER=array
-QUEUE_DRIVER=sync
+# QUEUE_CONNECTION, not QUEUE_DRIVER: the old Laravel 4/5 name is ignored by the
+# framework. Must not be 'sync' on any deployed environment.
+QUEUE_CONNECTION=sync
 
 SCOUT_DRIVER=null
 ALGOLIA_APP_ID=
@@ -29,8 +44,8 @@ ALGOLIA_SECRET=
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_DEFAULT_REGION=eu-west-1
-AWS_BUCKET=codeweek-dev
-AWS_URL=https://codeweek-s3.s3.amazonaws.com/
+AWS_BUCKET=
+AWS_URL=
 
 LOG_CHANNEL=stack
 LOG_STACK=single
@@ -48,6 +63,81 @@ SESSION_DOMAIN=null
 
 AUTH_MODEL=App\User
 
+# ---------------------------------------------------------------------------
+# Mail. Required in every deployed environment; the app sends certificates,
+# contact form submissions and moderation notices.
+# ---------------------------------------------------------------------------
+MAIL_MAILER=smtp
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_ENCRYPTION=tls
+MAIL_FROM_ADDRESS=
+MAIL_FROM_NAME="EU Code Week"
+# Falls back to ADMIN_EMAIL when unset
+CONTACT_FORM_RECIPIENT_EMAIL=
+
+# ---------------------------------------------------------------------------
+# Social login. LoginController allowlists twitter, github, google, facebook.
+# ---------------------------------------------------------------------------
+TWITTER_CLIENT_ID=
+TWITTER_CLIENT_SECRET=
+TWITTER_REDIRECT=
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_REDIRECT=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT=
+FACEBOOK_CLIENT_ID=
+FACEBOOK_CLIENT_SECRET=
+FACEBOOK_REDIRECT=
+
+# ---------------------------------------------------------------------------
+# Maps and geolocation
+# ---------------------------------------------------------------------------
+MAPS_MAPBOX_ACCESS_TOKEN=
+MAP_TILES=
+MAXMIND_USER_ID=
+MAXMIND_LICENSE_KEY=
+IPAPI_KEY=
+
+# ---------------------------------------------------------------------------
+# Certificates. PDFLATEX_PATH must point at a real pdflatex binary or the
+# whole certificate pipeline fails. See docs/handover/08-certificates.md
+# ---------------------------------------------------------------------------
+PDFLATEX_PATH=
+
+# ---------------------------------------------------------------------------
+# Storage. RESOURCES_BUCKET is a second bucket for Learn & Teach PDFs, and is
+# commonly pointed at production even on dev - check before importing.
+# ---------------------------------------------------------------------------
+FILESYSTEM_CLOUD=s3
+RESOURCES_BUCKET=
+RESOURCES_URL=
+BULK_UPLOAD_TEMP_DISK=local
+RESOURCES_IMPORT_TEMP_DISK=local
+
+# ---------------------------------------------------------------------------
+# Bot protection (Cloudflare Turnstile). Either TURNSTILE_SECRET or
+# TURNSTILE_SECRET_KEY is accepted; verification is skipped when both are blank.
+# ---------------------------------------------------------------------------
+TURNSTILE_SITEKEY=
+TURNSTILE_SECRET=
+
+# ---------------------------------------------------------------------------
+# Partner feeds and integrations
+# ---------------------------------------------------------------------------
+BLOG_URL=
+EEDUCATION_CLIENTID=
+RELOCATION_COUNTRY=
+# Bearer token for the internal support API
+SUPPORT_SERVICE_TOKEN=
+
+# Error monitoring
+SENTRY_LARAVEL_DSN=
+
 # ---------------------------------------------------------------------------
 # Support AI copilot (Phase 1: AI triage + frontend code PRs)
 # ---------------------------------------------------------------------------

.github/workflows/laravel.yml

@@ -2,9 +2,9 @@ name: Laravel
 
 on:
   push:
-    branches: [ master ]
+    branches: [ master, dev ]
   pull_request:
-    branches: [ master ]
+    branches: [ master, dev ]
 
 jobs:
   laravel-tests:

.gitignore

@@ -32,3 +32,16 @@ vite.config.js
 resources/excel/example.xlsx
 resources/ai-agent-plans/*
 /docs/internal/
+
+# pdflatex writes personalised .tex files and its logs into resources/latex at
+# runtime. Only the templates belong in git.
+resources/latex/*.aux
+resources/latex/*.log
+/texput.log
+
+# Debugging leftovers that have been committed by accident before
+cookies.txt
+changed_files.txt
+differences.diff
+/bom.json
+/phpunit.xml.bak

app/Console/Commands/CertificatePreflight.php

@@ -9,7 +9,7 @@
 class CertificatePreflight extends Command
 {
     protected $signature = 'certificate:preflight
-                            {--edition=2025 : Target edition year}
+                            {--edition= : Target edition year (defaults to the current year)}
                             {--type=all : excellence|super-organiser|all}
                             {--limit=0 : Max records to test (0 = all)}
                             {--batch-size=500 : Process in batches; 0 = single run}
@@ -22,7 +22,7 @@ class CertificatePreflight extends Command
 
     public function handle(): int
     {
-        $edition = (int) $this->option('edition');
+        $edition = (int) ($this->option('edition') ?: date('Y'));
         $typeOption = strtolower(trim((string) $this->option('type')));
         $limit = max(0, (int) $this->option('limit'));
         $batchSize = max(0, (int) $this->option('batch-size'));

app/Http/Controllers/ContactFormController.php

@@ -17,6 +17,8 @@ public function submit(Request $request)
             abort(403, 'Spam detected.');
         }
 
+        $turnstileSecret = config('codeweek.turnstile_secret');
+
         $validated = $request->validate([
             'first_name' => 'required|string|max:255',
             'last_name'  => 'required|string|max:255',
@@ -25,13 +27,13 @@ public function submit(Request $request)
             'subject'    => 'required|string',
             'message'    => 'required|string',
             'terms'      => 'accepted',
-            'cf-turnstile-response' => env('TURNSTILE_SECRET_KEY') ? 'required' : 'nullable',
+            'cf-turnstile-response' => $turnstileSecret ? 'required' : 'nullable',
         ]);
 
         // Verify CAPTCHA via Cloudflare Turnstile
-        if (env('TURNSTILE_SECRET_KEY')) {
+        if ($turnstileSecret) {
             $response = Http::asForm()->post('https://challenges.cloudflare.com/turnstile/v0/siteverify', [
-                'secret'   => env('TURNSTILE_SECRET_KEY'),
+                'secret'   => $turnstileSecret,
                 'response' => $request->input('cf-turnstile-response'),
                 'remoteip' => $request->ip(),
             ]);
@@ -51,7 +53,7 @@ public function submit(Request $request)
         $view = view()->exists("emails.$locale.contact") ? "emails.$locale.contact" : 'emails.en.contact';
 
         Mail::send($view, ['data' => $validated], function ($message) use ($validated) {
-            $message->to(env('CONTACT_FORM_RECIPIENT_EMAIL', 'bernard@matrixinternet.ie'))
+            $message->to(config('codeweek.contact_form_recipient'))
                     ->subject('New Contact Form Submission')
                     ->replyTo($validated['email'], $validated['first_name'] . ' ' . $validated['last_name']);
         });