User API starts without required Keycloak configuration and fails at runtime

[namrata-x]

Describe the bug
The User API starts successfully even when required Keycloak configuration, such as PRIVATE_KEYCLOAK_BASE_URL, is missing or blank. Auth-related endpoints then fail at runtime with 500 Internal Server Error and the message Invalid URL.

To Reproduce
Steps to reproduce the behavior:

1. Leave PRIVATE_KEYCLOAK_BASE_URL unset or blank in the User API environment.

2. Start the User API.

3. Call /login with a valid request body:

   curl -i -X POST http://localhost:8080/login \
     -H "Content-Type: application/json" \
     -d '{
       "username": "testuser",
       "password": "password123"
     }'

4. The response is:

   HTTP/1.1 500 Internal Server Error
   

   {
     "statusCode": 500,
     "message": "Invalid URL"
   }

5. The same runtime error can also occur on /me when the application attempts to use the missing Keycloak URL.

Expected behavior
Required Keycloak environment variables should be validated during application startup. If a required value is missing, the application should fail with a clear configuration error instead of starting successfully and returning 500 Invalid URL later at request time.

Screenshots
N/A. Reproduced using terminal requests and local application logs.

Node.js version
Node.js v20.20.2

Desktop (please complete the following information):

• OS: macOS
• Browser: N/A — reproduced using terminal/curl
• Version: N/A

Smartphone (please complete the following information):

• Device: N/A
• OS: N/A
• Browser: N/A
• Version: N/A

Additional context
apps/user/.env.example includes PRIVATE_KEYCLOAK_BASE_URL but leaves the value blank.

The application loads configuration using:

ConfigModule.forRoot({
  envFilePath: ENV === "dev" ? ".dev.env" : ".env",
})

There is currently no startup validate: configuration for the required Keycloak environment variables.

PRIVATE_KEYCLOAK_BASE_URL is later read directly from process.env in the User and Auth services, which results in an invalid URL being constructed when the value is missing.