safe-global / safe-events-service / 42029761545

88%

Build Type

push

github

Committed by web-flow

Commit Message

feat: Validate environment config at startup (#646)

* feat: Validate environment config at startup

- Add `EnvironmentVariables` (class-validator) with every env var, its type
  and default. The app does not start if a required var is missing or a value
  is invalid, and the error lists every problem
- Read config with typed `ConfigService.get(KEY, { infer: true })`. Remove
  hand-written number and boolean parsing and the defaults passed to `get`
- Make `ConfigModule` global and remove it from feature modules
- Read `URL_BASE_PATH`, `LOG_LEVEL`, `NODE_ENV` and the admin secrets through
  ConfigService instead of `process.env` at import time, so values set only in
  `.env` are applied
- Sync the DB schema only for `development`, `dev` and `test`, instead of for
  any `NODE_ENV` other than `production`
- Add missing admin secrets to `.env.docker`
- Update README config table, `.env.sample` and AGENTS.md

* docs: Name ormconfig.ts as the only direct process.env reader

* test: Cover database SSL options

* refactor: Rename adminRoot to adminBasePath in admin response patches

* refactor: Rename details to errorMessages in validate

* fix: Fail at startup on a blank SSE_AUTH_TOKEN

An empty SSE_AUTH_TOKEN disables SSE auth. The validation treated a
whitespace-only value as unset, so it fell back to the empty default and
turned auth off without any error.

A whitespace-only token, or one with whitespace inside, now stops the
app at startup. Outer whitespace is trimmed, so a trailing newline from
a secret file does not stop the pod.

* fix: Hide credentials when logging AMQP_URL

getAmqpUrl() logged the full AMQP_URL, password included. The log now
shows only scheme, host, port and vhost. The URL is not parsed, because
a password with unencoded #, / or ? is read as port, path or fragment
and would not be hidden.

Coverage Stats

458 of 536 branches covered (85.45%)

Branch coverage included in aggregate %.

159 of 172 new or added lines in 19 files covered. (92.44%)

1 existing line in 1 file now uncovered.

817 of 917 relevant lines covered (89.09%)

108.99 hits per line