quentin_duwa/dinggadingga-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sync): harden the Hiboutik sync, share rate limits across instances, update dependencies (#4)

Browse Source
This commit is contained in:
quentin_duwa
2026-11-08 13:45:08 +00:00
parent 04960379e8
commit d07c4df52d
62 changed files with 1546 additions and 639 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
src/config/env.validation.ts
View File

@@ -1,8 +1,17 @@
import { plainToInstance } from 'class-transformer';
import { IsInt, IsNotEmpty, IsOptional, IsString, IsUrl, Max, Min, validateSync } from 'class-validator';
import { IsIn, IsInt, IsNotEmpty, IsOptional, IsString, IsUrl, Max, Min, validateSync } from 'class-validator';
/** `sslmode` values that encrypt the database connection (the pg driver treats them all as `verify-full`). */
const SECURE_SSL_MODES = ['require', 'verify-ca', 'verify-full'];
/** Environment variables read by the app. A missing or malformed required one stops the startup. */
export class EnvironmentVariables {
/** `production` enforces production-only rules (TLS to the database). */
@IsOptional()
@IsIn(['development', 'production', 'test'])
NODE_ENV?: string;
/** In production, `sslmode` must be require, verify-ca or verify-full: customer data must not travel in clear. */
@IsString()
@IsNotEmpty()
DATABASE_URL!: string;
@@ -36,6 +45,25 @@ export class EnvironmentVariables {
@Min(1)
@Max(10)
TRUST_PROXY?: number;
/**
* Seconds a shutting down instance waits for its running synchronization (default 25). Keep it below the grace period
* of the orchestrator (Docker `stop_grace_period`, Kubernetes `terminationGracePeriodSeconds`), which kills afterwards.
*/
@IsOptional()
@IsInt()
@Min(0)
@Max(3600)
SYNC_SHUTDOWN_TIMEOUT?: number;
}
/** Whether the connection string asks for an encrypted connection. An unparsable one does not. */
function hasSecureSslMode(databaseUrl: string): boolean {
try {
return SECURE_SSL_MODES.includes(new URL(databaseUrl).searchParams.get('sslmode') ?? '');
} catch {
return false;
}
}
/** `ConfigModule` validation hook: fails fast with the names of the faulty variables (never their values, they may be secrets). */
@@ -43,9 +71,13 @@ export function validateEnv(config: Record<string, unknown>): Record<string, unk
const validated = plainToInstance(EnvironmentVariables, config, { enableImplicitConversion: true });
const errors = validateSync(validated, { whitelist: false });
if (errors.length > 0) {
const details = errors.map((error) => `${error.property}: ${Object.values(error.constraints ?? {}).join(', ')}`).join('\n ');
throw new Error(`Invalid environment configuration:\n ${details}`);
const details = errors.map((error) => `${error.property}: ${Object.values(error.constraints ?? {}).join(', ')}`);
if (validated.NODE_ENV === 'production' && validated.DATABASE_URL && !hasSecureSslMode(validated.DATABASE_URL)) {
details.push(`DATABASE_URL: sslmode must be one of ${SECURE_SSL_MODES.join(', ')} in production`);
}
if (details.length > 0) {
throw new Error(`Invalid environment configuration:\n ${details.join('\n ')}`);
}
return config;
}