Merge pull request #694 from Sadeequ/strl-lit

issue: 570,571,685,690

Author: Nabeelahh

BackendAcademy/.env.example

@@ -3,32 +3,43 @@ PORT=3000
 NODE_ENV=development
 
 # Database
+# REQUIRED in production. Local/development uses the default below when omitted.
 DATABASE_URL=postgresql://postgres:password@localhost:5432/rustacademy
 
 # Redis
+# REQUIRED in production. Defaults to localhost in development/test.
 REDIS_HOST=localhost
 REDIS_PORT=6379
 REDIS_PASSWORD=
 
 # Auth
+# REQUIRED in production with >= 32 chars and NOT a placeholder value.
+# Development/test use explicit non-production defaults when omitted.
 JWT_SECRET=change_me_in_production
 
+# Signing secret for signed asset download URLs.
+# REQUIRED in production; an empty value makes signed URLs forgeable.
+ASSET_SIGNING_SECRET=change_me_in_production
+
 # API Keys
 API_KEY_SECRET=change_me_in_production
 
 # CORS
+# "*" or a comma-separated list of origins.
 CORS_ORIGIN=http://localhost:3000
 
 # AI Provider
 AI_PROVIDER=mock            # claude | openai | mock
-ANTHROPIC_API_KEY=           # Your Anthropic API key
-OPENAI_API_KEY=              # Your OpenAI API key
-AI_MODEL=                    # Model override (optional)
+ANTHROPIC_API_KEY=          # Required when AI_PROVIDER=claude
+OPENAI_API_KEY=             # Required when AI_PROVIDER=openai
+AI_MODEL=                   # Model override (optional)
 AI_MAX_TOKENS=4096
 AI_TEMPERATURE=0.7
 
 # Static & uploaded assets
 ASSETS_UPLOAD_DIR=./data/uploads  # Where uploaded assets are persisted on disk
-ASSETS_MAX_SIZE_MB=10             # Max upload size in megabytes
+ASSETS_MAX_SIZE_MB=10             # Per-file upload size limit in megabytes
+ASSETS_MAX_TOTAL_MB=1024          # Aggregate byte quota across all stored assets (MB)
+ASSETS_MAX_COUNT=10000            # Maximum number of assets retained by the registry
 ASSETS_BASE_URL=/api/v1/assets    # Base URL advertised inside asset metadata
 ASSETS_STATIC_DIR=./public        # Read-only static asset directory served at /static

BackendAcademy/envcheck.tmp.ts

@@ -0,0 +1,53 @@
+import * as dotenv from 'dotenv';
+import * as fs from 'fs';
+import { envValidationSchema, ENV_VALIDATION_OPTIONS, NON_PRODUCTION_DEFAULTS } from './src/config/env.schema';
+
+function run(label: string, env: Record<string, unknown>) {
+  const { error, value } = envValidationSchema.validate(env, ENV_VALIDATION_OPTIONS);
+  console.log('---', label);
+  if (error) console.log('  ERROR:', error.message);
+  else console.log('  OK  ', JSON.stringify({
+    NODE_ENV: value.NODE_ENV, PORT: value.PORT, CORS_ORIGIN: value.CORS_ORIGIN,
+    DATABASE_URL: value.DATABASE_URL, REDIS_HOST: value.REDIS_HOST, REDIS_PORT: value.REDIS_PORT,
+    JWT_SECRET: value.JWT_SECRET, ASSET_SIGNING_SECRET: value.ASSET_SIGNING_SECRET,
+    AI_PROVIDER: value.AI_PROVIDER, ASSETS_MAX_SIZE_MB: value.ASSETS_MAX_SIZE_MB,
+  }));
+}
+
+run('empty (development)', {});
+run('test', { NODE_ENV: 'test' });
+run('example env file', dotenv.parse(fs.readFileSync('.env.example')));
+run('production empty', { NODE_ENV: 'production' });
+run('production with placeholder secrets', {
+  NODE_ENV: 'production',
+  DATABASE_URL: 'postgresql://u:supersecretpw@db:5432/app',
+  REDIS_HOST: 'redis',
+  JWT_SECRET: 'change_me_in_production',
+  ASSET_SIGNING_SECRET: NON_PRODUCTION_DEFAULTS.development.ASSET_SIGNING_SECRET,
+});
+run('production short secret', {
+  NODE_ENV: 'production',
+  DATABASE_URL: 'postgresql://u:supersecretpw@db:5432/app',
+  REDIS_HOST: 'redis',
+  JWT_SECRET: 'tooshort-abc',
+  ASSET_SIGNING_SECRET: 'x'.repeat(40),
+});
+run('production bad db url', {
+  NODE_ENV: 'production',
+  DATABASE_URL: 'ftp://user:supersecretpw@db/app',
+  REDIS_HOST: 'redis',
+  JWT_SECRET: 'a'.repeat(40),
+  ASSET_SIGNING_SECRET: 'b'.repeat(40),
+});
+run('production valid', {
+  NODE_ENV: 'production',
+  DATABASE_URL: 'postgresql://u:pw@db:5432/app',
+  REDIS_HOST: 'redis',
+  JWT_SECRET: 'a'.repeat(40),
+  ASSET_SIGNING_SECRET: 'b'.repeat(40),
+  CORS_ORIGIN: 'https://a.example, https://b.example',
+});
+run('claude without key', { AI_PROVIDER: 'claude' });
+run('unknown vars', { PATH: '/usr/bin', SOME_RANDOM: 'x' });
+run('bad node env', { NODE_ENV: 'staging' });
+run('bad redis port', { REDIS_PORT: -1 });