gitmost/apps/server/src/integrations/environment/environment.validation.ts

import {
  IsIn,
  IsNotEmpty,
  IsNotIn,
  IsNumberString,
  IsOptional,
  IsString,
  IsUrl,
  MinLength,
  ValidateIf,
  validateSync,
} from 'class-validator';
import { plainToInstance } from 'class-transformer';
import { IsISO6391 } from '../../common/validators/is-iso6391';

export class EnvironmentVariables {
  @IsNotEmpty()
  @IsUrl(
    {
      protocols: ['postgres', 'postgresql'],
      require_tld: false,
      allow_underscores: true,
    },
    { message: 'DATABASE_URL must be a valid postgres connection string' },
  )
  DATABASE_URL: string;

  @IsNotEmpty()
  @IsUrl(
    {
      protocols: ['redis', 'rediss'],
      require_tld: false,
      allow_underscores: true,
    },
    { message: 'REDIS_URL must be a valid redis connection string' },
  )
  REDIS_URL: string;

  @IsOptional()
  @IsUrl({ protocols: ['http', 'https'], require_tld: false })
  APP_URL: string;

  @IsNotEmpty()
  @MinLength(32)
  @IsNotIn(['REPLACE_WITH_LONG_SECRET'])
  APP_SECRET: string;

  @IsOptional()
  @IsIn(['smtp', 'postmark'])
  MAIL_DRIVER: string;

  @IsOptional()
  @IsIn(['local', 's3', 'azure'])
  STORAGE_DRIVER: string;

  @IsOptional()
  @ValidateIf((obj) => obj.COLLAB_URL != '' && obj.COLLAB_URL != null)
  @IsUrl({ protocols: ['http', 'https'], require_tld: false })
  COLLAB_URL: string;

  @IsOptional()
  CLOUD: boolean;

  @IsOptional()
  @IsUrl(
    { protocols: [], require_tld: true },
    {
      message:
        'SUBDOMAIN_HOST must be a valid FQDN domain without the http protocol. e.g example.com',
    },
  )
  @ValidateIf((obj) => obj.CLOUD === 'true'.toLowerCase())
  SUBDOMAIN_HOST: string;

  @IsOptional()
  @IsIn(['database', 'typesense'])
  @IsString()
  SEARCH_DRIVER: string;

  @IsOptional()
  @IsUrl(
    {
      protocols: ['http', 'https'],
      require_tld: false,
      allow_underscores: true,
    },
    {
      message:
        'TYPESENSE_URL must be a valid typesense url e.g http://localhost:8108',
    },
  )
  @ValidateIf((obj) => obj.SEARCH_DRIVER === 'typesense')
  TYPESENSE_URL: string;

  @ValidateIf((obj) => obj.SEARCH_DRIVER === 'typesense')
  @IsNotEmpty()
  @IsString()
  TYPESENSE_API_KEY: string;

  @IsOptional()
  @ValidateIf((obj) => obj.SEARCH_DRIVER === 'typesense')
  @IsISO6391()
  @IsString()
  TYPESENSE_LOCALE: string;

  @IsOptional()
  @ValidateIf((obj) => obj.AI_DRIVER)
  @IsIn(['openai', 'openai-compatible', 'gemini', 'ollama'])
  @IsString()
  AI_DRIVER: string;

  @IsOptional()
  @IsString()
  AI_EMBEDDING_MODEL: string;

  @ValidateIf((obj) => obj.AI_EMBEDDING_DIMENSION)
  @IsIn(['768', '1024', '1536', '2000', '3072'])
  @IsString()
  AI_EMBEDDING_DIMENSION: string;

  @IsOptional()
  @ValidateIf((obj) => obj.AI_EMBEDDING_SUPPORTS_MRL)
  @IsIn(['true', 'false'])
  @IsString()
  AI_EMBEDDING_SUPPORTS_MRL: string;

  @ValidateIf((obj) => obj.AI_DRIVER)
  @IsString()
  @IsNotEmpty()
  AI_COMPLETION_MODEL: string;

  @IsOptional()
  @ValidateIf(
    (obj) =>
      obj.AI_DRIVER && ['openai', 'openai-compatible'].includes(obj.AI_DRIVER),
  )
  @IsString()
  @IsNotEmpty()
  OPENAI_API_KEY: string;

  @IsOptional()
  @ValidateIf(
    (obj) =>
      obj.AI_DRIVER === 'openai-compatible' ||
      (obj.AI_DRIVER === 'openai' && obj.OPENAI_API_URL),
  )
  @IsUrl({ protocols: ['http', 'https'], require_tld: false })
  OPENAI_API_URL: string;

  @ValidateIf((obj) => obj.AI_DRIVER && obj.AI_DRIVER === 'gemini')
  @IsString()
  @IsNotEmpty()
  GEMINI_API_KEY: string;

  @ValidateIf((obj) => obj.AI_DRIVER && obj.AI_DRIVER === 'ollama')
  @IsUrl({ protocols: ['http', 'https'], require_tld: false })
  OLLAMA_API_URL: string;

  @IsOptional()
  @IsIn(['postgres', 'clickhouse'])
  @IsString()
  EVENT_STORE_DRIVER: string;

  @ValidateIf((obj) => obj.EVENT_STORE_DRIVER === 'clickhouse')
  @IsNotEmpty()
  @IsUrl(
    { protocols: ['http', 'https'], require_tld: false },
    {
      message:
        'CLICKHOUSE_URL must be a valid URL e.g http://user:password@localhost:8123/docmost',
    },
  )
  CLICKHOUSE_URL: string;

  // --- git-sync (issue #194 §7.2) — all OPTIONAL. The master switch defaults off; a
  // required-if-enabled service user id is validated only when sync is on. ---

  @IsOptional()
  @IsIn(['true', 'false'])
  @IsString()
  GIT_SYNC_ENABLED: string;

  // Whether to serve the per-space vaults over smart-HTTP (the /git host).
  // When unset, defaults to GIT_SYNC_ENABLED (see isGitSyncHttpEnabled).
  @IsOptional()
  @IsIn(['true', 'false'])
  @IsString()
  GIT_SYNC_HTTP_ENABLED: string;

  @IsOptional()
  @IsString()
  GIT_SYNC_DATA_DIR: string;

  // SCAFFOLDING for the deferred remote-push feature: the vendored engine does
  // not consume gitRemote yet (SPEC §7), so this is currently inert — validated
  // here so the wiring is ready when remote push lands.
  @IsOptional()
  @IsString()
  GIT_SYNC_REMOTE_TEMPLATE: string;

  @IsOptional()
  @IsString()
  GIT_SYNC_POLL_INTERVAL_MS: string;

  @IsOptional()
  @IsString()
  GIT_SYNC_DEBOUNCE_MS: string;

  // Watchdog timeout (ms) for the spawned `git http-backend` process (default
  // 120000): a stalled receive-pack is killed so it cannot hold the per-space
  // lock forever. Optional int (validated as a string env).
  @IsOptional()
  @IsString()
  GIT_SYNC_BACKEND_TIMEOUT_MS: string;


  // Required when git-sync is enabled: the service user create/move/rename/delete
  // are attributed to (issue #194 §7.2). Optional otherwise.
  @ValidateIf((obj) => obj.GIT_SYNC_ENABLED === 'true')
  @IsNotEmpty()
  @IsString()
  GIT_SYNC_SERVICE_USER_ID: string;

  // --- Blob sandbox (in-RAM ephemeral blob transfer; see SandboxModule) ---

  @IsOptional()
  @ValidateIf((obj) => obj.SANDBOX_PUBLIC_URL != '' && obj.SANDBOX_PUBLIC_URL != null)
  @IsUrl(
    { protocols: ['http', 'https'], require_tld: false },
    {
      message:
        'SANDBOX_PUBLIC_URL must be a valid http(s) URL reachable by the external blob consumer',
    },
  )
  SANDBOX_PUBLIC_URL: string;

  @IsOptional()
  @IsNumberString({}, { message: 'SANDBOX_TTL_MS must be an integer (milliseconds)' })
  SANDBOX_TTL_MS: string;

  @IsOptional()
  @IsNumberString({}, { message: 'SANDBOX_MAX_BYTES must be an integer (bytes)' })
  SANDBOX_MAX_BYTES: string;

  @IsOptional()
  @IsNumberString({}, { message: 'SANDBOX_MAX_IMAGE_BYTES must be an integer (bytes)' })
  SANDBOX_MAX_IMAGE_BYTES: string;

  @IsOptional()
  @IsNumberString({}, { message: 'SANDBOX_MAX_TOTAL_BYTES must be an integer (bytes)' })
  SANDBOX_MAX_TOTAL_BYTES: string;
}

export function validate(config: Record<string, any>) {
  const validatedConfig = plainToInstance(EnvironmentVariables, config);

  const errors = validateSync(validatedConfig);

  if (errors.length > 0) {
    console.error(
      'The Environment variables has failed the following validations:',
    );

    errors.map((error) => {
      console.error(JSON.stringify(error.constraints));
    });

    console.error(
      'Please fix the environment variables and try again. Exiting program...',
    );
    process.exit(1);
  }

  return validatedConfig;
}