From e2abbfbe75f72899b88816854a4f94fa3f317dc5 Mon Sep 17 00:00:00 2001
From: seo <seo@chaegeon.com>
Date: Fri, 30 Oct 2026 22:23:16 +0900
Subject: [PATCH] security: load vehicle API token from secret file

---
 common.php | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/common.php b/common.php
index b246c7c..09d459d 100644
--- a/common.php
+++ b/common.php
@@ -7,8 +7,17 @@ $carSecretFile = __DIR__ . '/../../config/car.php';
 if (!is_file($carSecretFile)) {
     throw new RuntimeException('Missing car secret config: ' . $carSecretFile);
 }
+
+$carApiTokenFile = __DIR__ . '/../../config/.car-api-token.php';
+if (!is_file($carApiTokenFile) || !is_readable($carApiTokenFile)) {
+    throw new RuntimeException('Missing car API token file');
+}
 
 $carSecretConfig = require $carSecretFile;
+$carApiToken = trim((string)(require $carApiTokenFile));
+if ($carApiToken === '') {
+    throw new RuntimeException('Empty car API token file');
+}
 $carTcpConfig = is_array($carSecretConfig['tcp'] ?? null) ? $carSecretConfig['tcp'] : [];
 $carIdentityConfig = is_array($carSecretConfig['identity'] ?? null) ? $carSecretConfig['identity'] : [];
 $carDbConfig = is_array($carSecretConfig['db'] ?? null) ? $carSecretConfig['db'] : [];
@@ -30,7 +39,7 @@ define('DB_USER', (string)($carDbConfig['user'] ?? 'car'));
 define('DB_PASS', (string)($carDbConfig['pass'] ?? ''));
 define('DB_CHARSET', (string)($carDbConfig['charset'] ?? 'utf8mb4'));
 
-define('AUTH_TOKEN', (string)($carSecretConfig['auth_token'] ?? ''));
+define('AUTH_TOKEN', $carApiToken);
 
 define('ALLOWED_IPS', array_values(array_filter(
     (array)($carSecretConfig['allowed_ips'] ?? []),