Fix staging vs production URL confusion — application.conf vs Application.kt default

[GavT]

Summary

There is a conflict between two backend URLs:

• backend/src/main/resources/application.conf sets baseUrl = "https://stg.fuel-finder.ics.gov.uk" (staging)
• Application.kt defaults to the production URL "https://fuel-finder.service.gov.uk" if the config key is absent

This means the deployed backend may be hitting the staging UK Gov API depending on how the config file is packaged, serving stale or test data to real users.

What to change

1. Decide on a single source of truth: use application.conf for all environments
2. Create environment-specific config files:
   • application.conf — production (production URL)
   • application-dev.conf — development/staging URL
3. Set KTOR_ENV=dev or equivalent in the dev deployment
4. Add a startup log line confirming which URL is active:

   log.info("Fuel Finder baseUrl: $baseUrl")

5. Rotate any credentials if staging/prod tokens have been mixed

Workstream: WS1 Phase 1A

[GavT]

Status update — practical risk mitigated by env-var override, code-level fix still wanted

The deployed EB env uses staging via application.conf (baseUrl = "https://stg.fuel-finder.ics.gov.uk") and that's what's actually getting hit — confirmed via web.stdout.log showing OAuth calls to stg.fuel-finder.ics.gov.uk. So the inconsistency described in this issue isn't currently sending traffic to prod.

The latent risk remains though: Application.kt:32 still falls back to the prod URL if application.conf's baseUrl key ever goes missing (e.g. someone edits the config, a future deployer overrides with an empty env var). The two defaults should agree. Lowest-friction fix is to change Application.kt's fallback to the staging URL too, since staging is what we actually run on.

Setting P2 — not currently broken but it's a foot-gun in waiting and the fix is trivial.