Skip to content

Commit 12e6dca

Browse files
DylanVannDylanVann
committed
chore: refactor environment variables
1 parent 05344c5 commit 12e6dca

20 files changed

+226
-103
lines changed

‎.env.ci

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ DATABASE_OWNER_PASSWORD=cisecret1
77
DATABASE_AUTHENTICATOR=graphile_starter_authenticator
88
DATABASE_AUTHENTICATOR_PASSWORD=cisecret2
99
DATABASE_VISITOR=graphile_starter_visitor
10-
SECRET=cisecret3
11-
JWT_SECRET=cisecret4
10+
SECRET=cbGscssSrcSDmrOYm5vVvQIUmGoexyZuVcQVlpsn63XIIqofk63eGnl8WXPj2B0R
11+
JWT_SECRET=cbGscssSrcSDmrOYm5vVvQIUmGoexyZuVcQVlpsn63XIIqofk63eGnl8WXPj2B0R
1212
PORT=5678
1313
ROOT_URL=http://localhost:5678
1414
ENABLE_CYPRESS_COMMANDS=1

‎@app/config/src/index.ts

+114-6
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,121 @@
1+
import { defaultNumber, minLength, parseInteger, required } from "./validate";
2+
13
// @ts-ignore
24
const packageJson = require("../../../package.json");
35

46
// TODO: customise this with your own settings!
57

6-
export const fromEmail =
7-
'"PostGraphile Starter" <[email protected]>';
8-
export const awsRegion = "us-east-1";
9-
export const projectName = packageJson.name.replace(/[-_]/g, " ");
10-
export const companyName = projectName; // For copyright ownership
11-
export const emailLegalText =
8+
export const fromEmail: string = `"PostGraphile Starter" <[email protected]>`;
9+
export const awsRegion: string = "us-east-1";
10+
export const projectName: string = packageJson.name.replace(/[-_]/g, " ");
11+
export const companyName: string = projectName; // For copyright ownership
12+
export const emailLegalText: string =
1213
// Envvar here so we can override on the demo website
1314
process.env.LEGAL_TEXT || "<Insert legal email footer text here >";
15+
16+
export const SECRET: string = minLength(
17+
required({ value: process.env.SECRET, name: "SECRET" }),
18+
64
19+
).value;
20+
21+
export const JWT_SECRET: string = minLength(
22+
required({
23+
value: process.env.JWT_SECRET,
24+
name: "JWT_SECRET",
25+
}),
26+
64
27+
).value;
28+
29+
export const REDIS_URL: string | undefined = process.env.REDIS_URL;
30+
31+
export const DATABASE_URL: string = required({
32+
value: process.env.DATABASE_URL,
33+
name: "DATABASE_URL",
34+
}).value;
35+
36+
export const AUTH_DATABASE_URL: string = required({
37+
value: process.env.AUTH_DATABASE_URL,
38+
name: "AUTH_DATABASE_URL",
39+
}).value;
40+
41+
export const NODE_ENV: string = required({
42+
value: process.env.NODE_ENV,
43+
name: "NODE_ENV",
44+
}).value;
45+
46+
export const isDev: boolean = NODE_ENV === "development";
47+
48+
export const isTest: boolean = NODE_ENV === "test";
49+
50+
export const isDevOrTest: boolean = isDev || isTest;
51+
52+
export const ROOT_URL: string = required({
53+
value: process.env.ROOT_URL,
54+
name: "ROOT_URL",
55+
}).value;
56+
57+
export const TRUST_PROXY: string | undefined = process.env.TRUST_PROXY;
58+
59+
export const ENABLE_GRAPHIQL: boolean = !!process.env.ENABLE_GRAPHIQL;
60+
61+
export const GRAPHILE_LICENSE: string | undefined =
62+
process.env.GRAPHILE_LICENSE;
63+
// Pro plugin options (requires process.env.GRAPHILE_LICENSE)
64+
export const GRAPHQL_PAGINATION_CAP: number = defaultNumber(
65+
parseInteger({
66+
value: process.env.GRAPHQL_PAGINATION_CAP,
67+
name: "GRAPHQL_PAGINATION_CAP",
68+
}),
69+
50
70+
).value;
71+
export const GRAPHQL_DEPTH_LIMIT: number = defaultNumber(
72+
parseInteger({
73+
value: process.env.GRAPHQL_DEPTH_LIMIT,
74+
name: "GRAPHQL_DEPTH_LIMIT",
75+
}),
76+
12
77+
).value;
78+
export const GRAPHQL_COST_LIMIT: number = defaultNumber(
79+
parseInteger({
80+
value: process.env.GRAPHQL_COST_LIMIT,
81+
name: "GRAPHQL_COST_LIMIT",
82+
}),
83+
30000
84+
).value;
85+
export const HIDE_QUERY_COST: boolean =
86+
defaultNumber(
87+
parseInteger({
88+
value: process.env.HIDE_QUERY_COST,
89+
name: "HIDE_QUERY_COST",
90+
}),
91+
0
92+
).value < 1;
93+
94+
export const PORT: number = defaultNumber(
95+
parseInteger({ value: process.env.PORT, name: "PORT" }),
96+
3000
97+
).value;
98+
99+
export const ENABLE_CYPRESS_COMMANDS: boolean =
100+
process.env.ENABLE_CYPRESS_COMMANDS === "1";
101+
102+
export const GITHUB_KEY: string | undefined = process.env.GITHUB_KEY;
103+
export const GITHUB_SECRET: string | undefined = process.env.GITHUB_SECRET;
104+
105+
export const DATABASE_VISITOR: string | undefined =
106+
process.env.DATABASE_VISITOR;
107+
108+
const MILLISECOND = 1;
109+
const SECOND = 1000 * MILLISECOND;
110+
const MINUTE = 60 * SECOND;
111+
const HOUR = 60 * MINUTE;
112+
const DAY = 24 * HOUR;
113+
export const MAXIMUM_SESSION_DURATION_IN_MILLISECONDS: number = defaultNumber(
114+
parseInteger({
115+
value: process.env.MAXIMUM_SESSION_DURATION_IN_MILLISECONDS,
116+
name: "MAXIMUM_SESSION_DURATION_IN_MILLISECONDS",
117+
}),
118+
3 * DAY
119+
).value;
120+
121+
export const T_AND_C_URL: string | undefined = process.env.T_AND_C_URL;

‎@app/config/src/validate.ts

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Validation functions for environment variables.
3+
*
4+
* `name` is passed with `value` so that bundlers that replace
5+
* process.env.MY_VAR with the value will still provide useful error messages.
6+
*/
7+
8+
export const required = (v: {
9+
value?: string;
10+
name: string;
11+
}): { value: string; name: string } => {
12+
const { value, name } = v;
13+
if (!value || value === "") {
14+
throw new Error(
15+
`process.env.${name} is required but not defined - did you remember to run the setup script? Have you sourced the environmental variables file '.env'?`
16+
);
17+
}
18+
return v as any;
19+
};
20+
21+
export const minLength = (
22+
v: { value: string; name: string },
23+
minLength: number
24+
): { value: string; name: string } => {
25+
const { value, name } = v;
26+
if (value.length < minLength) {
27+
throw new Error(
28+
`process.env.${name} should have minimum length ${minLength}.`
29+
);
30+
}
31+
return v;
32+
};
33+
34+
export const parseInteger = (v: {
35+
value?: string;
36+
name: string;
37+
}): { value: number; name: string } => ({
38+
value: parseInt(v.value || "", 10),
39+
name: v.name,
40+
});
41+
42+
export const defaultNumber = (
43+
v: { value?: number; name: string },
44+
defaultValue: number
45+
): { value: number; name: string } => {
46+
const { value, name } = v;
47+
return {
48+
value: value === undefined || isNaN(value) ? defaultValue : value,
49+
name,
50+
};
51+
};

‎@app/server/src/app.ts

+5-10
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1+
import { isDev, isTest, TRUST_PROXY } from "@app/config";
12
import express, { Express } from "express";
23
import { Server } from "http";
34
import { Middleware } from "postgraphile";
45

56
import { cloudflareIps } from "./cloudflare";
67
import * as middleware from "./middleware";
78
import { makeShutdownActions, ShutdownAction } from "./shutdownActions";
8-
import { sanitizeEnv } from "./utils";
99

1010
// Server may not always be supplied, e.g. where mounting on a sub-route
1111
export function getHttpServer(app: Express): Server | void {
@@ -27,11 +27,6 @@ export async function makeApp({
2727
}: {
2828
httpServer?: Server;
2929
} = {}): Promise<Express> {
30-
sanitizeEnv();
31-
32-
const isTest = process.env.NODE_ENV === "test";
33-
const isDev = process.env.NODE_ENV === "development";
34-
3530
const shutdownActions = makeShutdownActions();
3631

3732
if (isDev) {
@@ -50,7 +45,7 @@ export async function makeApp({
5045
* server knows it's running in SSL mode, and so the logs can log the true
5146
* IP address of the client rather than the IP address of our proxy.
5247
*/
53-
if (process.env.TRUST_PROXY) {
48+
if (TRUST_PROXY) {
5449
/*
5550
We recommend you set TRUST_PROXY to the following:
5651
@@ -63,11 +58,11 @@ export async function makeApp({
6358
*/
6459
app.set(
6560
"trust proxy",
66-
process.env.TRUST_PROXY === "1"
61+
TRUST_PROXY === "1"
6762
? true
68-
: process.env.TRUST_PROXY === "cloudflare"
63+
: TRUST_PROXY === "cloudflare"
6964
? ["loopback", "linklocal", "uniquelocal", ...cloudflareIps]
70-
: process.env.TRUST_PROXY.split(",")
65+
: TRUST_PROXY.split(",")
7166
);
7267
}
7368

‎@app/server/src/index.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#!/usr/bin/env node
22
/* eslint-disable no-console */
3+
import { PORT } from "@app/config";
34
import chalk from "chalk";
45
import { createServer } from "http";
56

@@ -19,7 +20,6 @@ async function main() {
1920
httpServer.addListener("request", app);
2021

2122
// And finally, we open the listen port
22-
const PORT = parseInt(process.env.PORT || "", 10) || 3000;
2323
httpServer.listen(PORT, () => {
2424
const address = httpServer.address();
2525
const actualPort: string =

‎@app/server/src/middleware/installCSRFProtection.ts

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { ROOT_URL } from "@app/config";
12
import csrf from "csurf";
23
import { Express } from "express";
34

@@ -17,8 +18,8 @@ export default (app: Express) => {
1718
if (
1819
req.method === "POST" &&
1920
req.path === "/graphql" &&
20-
(req.headers.referer === `${process.env.ROOT_URL}/graphiql` ||
21-
req.headers.origin === process.env.ROOT_URL)
21+
(req.headers.referer === `${ROOT_URL}/graphiql` ||
22+
req.headers.origin === ROOT_URL)
2223
) {
2324
// Bypass CSRF for GraphiQL
2425
next();

‎@app/server/src/middleware/installCypressServerCommand.ts

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { ENABLE_CYPRESS_COMMANDS, isDevOrTest } from "@app/config";
12
import { urlencoded } from "body-parser";
23
import { Express, Request, RequestHandler, Response } from "express";
34
import { Pool } from "pg";
@@ -6,7 +7,7 @@ import { getRootPgPool } from "./installDatabasePools";
67

78
export default (app: Express) => {
89
// Only enable this in test/development mode
9-
if (!["test", "development"].includes(process.env.NODE_ENV || "")) {
10+
if (!isDevOrTest) {
1011
throw new Error("This code must not run in production");
1112
}
1213

@@ -15,7 +16,7 @@ export default (app: Express) => {
1516
* to be set; this gives us extra protection against accidental XSS/CSRF
1617
* attacks.
1718
*/
18-
const safeToRun = process.env.ENABLE_CYPRESS_COMMANDS === "1";
19+
const safeToRun = ENABLE_CYPRESS_COMMANDS;
1920

2021
const rootPgPool = getRootPgPool(app);
2122

‎@app/server/src/middleware/installDatabasePools.ts

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { AUTH_DATABASE_URL, DATABASE_URL } from "@app/config";
12
import { Express } from "express";
23
import { Pool } from "pg";
34

@@ -26,14 +27,14 @@ function swallowPoolError(_error: Error) {
2627
export default (app: Express) => {
2728
// This pool runs as the database owner, so it can do anything.
2829
const rootPgPool = new Pool({
29-
connectionString: process.env.DATABASE_URL,
30+
connectionString: DATABASE_URL,
3031
});
3132
rootPgPool.on("error", swallowPoolError);
3233
app.set("rootPgPool", rootPgPool);
3334

3435
// This pool runs as the unprivileged user, it's what PostGraphile uses.
3536
const authPgPool = new Pool({
36-
connectionString: process.env.AUTH_DATABASE_URL,
37+
connectionString: AUTH_DATABASE_URL,
3738
});
3839
authPgPool.on("error", swallowPoolError);
3940
app.set("authPgPool", authPgPool);

‎@app/server/src/middleware/installErrorHandler.ts

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
1+
import { isDev } from "@app/config";
12
import { ErrorRequestHandler, Express } from "express";
23
import * as fs from "fs";
34
import { template, TemplateExecutor } from "lodash";
45
import { resolve } from "path";
56

6-
const isDev = process.env.NODE_ENV === "development";
7-
87
interface ParsedError {
98
message: string;
109
status: number;

‎@app/server/src/middleware/installHelmet.ts

+1-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
1+
import { isDevOrTest } from "@app/config";
12
import { Express } from "express";
23
import helmet from "helmet";
34

4-
const isDevOrTest =
5-
process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
6-
75
export default function installHelmet(app: Express) {
86
app.use(
97
helmet(

‎@app/server/src/middleware/installLogging.ts

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1+
import { isDev } from "@app/config";
12
import { Express } from "express";
23
import morgan from "morgan";
34

4-
const isDev = process.env.NODE_ENV === "development";
5-
65
export default (app: Express) => {
76
if (isDev) {
87
// To enable logging on development, uncomment the next line:

‎@app/server/src/middleware/installPassport.ts

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { GITHUB_KEY, GITHUB_SECRET } from "@app/config";
12
import { Express } from "express";
23
import { get } from "lodash";
34
import passport from "passport";
@@ -40,14 +41,14 @@ export default async (app: Express) => {
4041
res.redirect("/");
4142
});
4243

43-
if (process.env.GITHUB_KEY) {
44+
if (GITHUB_KEY) {
4445
await installPassportStrategy(
4546
app,
4647
"github",
4748
GitHubStrategy,
4849
{
49-
clientID: process.env.GITHUB_KEY,
50-
clientSecret: process.env.GITHUB_SECRET,
50+
clientID: GITHUB_KEY,
51+
clientSecret: GITHUB_SECRET,
5152
scope: ["user:email"],
5253
},
5354
{},

‎@app/server/src/middleware/installPassportStrategy.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { ROOT_URL } from "@app/config";
12
import { Express, Request, RequestHandler } from "express";
23
import passport from "passport";
34

@@ -81,7 +82,7 @@ export default (
8182
new Strategy(
8283
{
8384
...strategyConfig,
84-
callbackURL: `${process.env.ROOT_URL}/auth/${service}/callback`,
85+
callbackURL: `${ROOT_URL}/auth/${service}/callback`,
8586
passReqToCallback: true,
8687
},
8788
async (

0 commit comments

Comments
 (0)