Env validatsiyasi Zod bilan: tipli config obyekti va fail-fast

import { z } from "zod";

const EnvSxemasi = z.object({
  NODE_ENV: z.enum(["development", "production", "test"])
    .default("development"),
  PORT: z.coerce.number().int().min(0).max(65_535).default(3000),
  HOST: z.string().min(1).default("127.0.0.1"),
  SAQLASH: z.enum(["xotira", "fayl"]).default("xotira"),
});

const c = EnvSxemasi.parse({ PORT: "4100" });
console.log(c);
console.log(typeof c.PORT);

{
  NODE_ENV: 'development',
  PORT: 4100,
  HOST: '127.0.0.1',
  SAQLASH: 'xotira'
}
number

import { z } from "zod";

const EnvSxemasi = z.object({
  PORT: z.coerce.number().int().min(0).max(65_535).default(3000),
  SAQLASH: z.enum(["xotira", "fayl"]).default("xotira"),
  WEBHOOK_URL: z.url().optional(),
});

const n = EnvSxemasi.safeParse({
  PORT: "yuz",
  SAQLASH: "mongo",
  WEBHOOK_URL: "parol-bor-manzil",
});
if (!n.success) console.log(z.prettifyError(n.error));

✖ Invalid input: expected number, received NaN
  → at PORT
✖ Invalid option: expected one of "xotira"|"fayl"
  → at SAQLASH
✖ Invalid URL
  → at WEBHOOK_URL

import { z } from "zod";

const Cors = z.string().default("")
  .transform((x) => x.split(",").map((o) => o.trim())
    .filter((o) => o !== ""))
  .pipe(z.array(z.url()));
const Rost = z.enum(["true", "false"])
  .transform((x) => x === "true");

console.log(Cors.parse(
  "http://localhost:5173, https://login.github.io"));
console.log(Cors.parse(undefined));
console.log(Rost.parse("false"), Rost.safeParse("TRUE").success);

[ 'http://localhost:5173', 'https://login.github.io' ]
[]
false false

.refine((e) => e.NODE_ENV !== "production" ||
    e.CORS_ORIGINS.length > 0,
  { error: "production'da CORS_ORIGINS majburiy",
    path: ["CORS_ORIGINS"] });

$ NODE_ENV=production node src/server.ts
Sozlama noto'g'ri:
✖ production'da CORS_ORIGINS majburiy
  → at CORS_ORIGINS
[exit 78]

{"PORT":"yuz","NODE_ENV":"production"} → Sozlama noto'g'ri: | ✖ Invalid input: expected number, received NaN |   → at PORT

export type Config = Readonly<z.output<typeof EnvSxemasi>>;

export class ConfigXatosi extends Error {
  constructor(xabar: string) {
    super(xabar);
    this.name = "ConfigXatosi";
  }
}

/** @param env odatda process.env; testda — oddiy obyekt */
export function configYukla(
    env: Record<string, string | undefined>): Config {
  const n = EnvSxemasi.safeParse(env);
  // qiymatlarning o'zi chiqarilmaydi (sir bo'lishi mumkin)
  if (!n.success) throw new ConfigXatosi(
    `Sozlama noto'g'ri:\n${z.prettifyError(n.error)}`);
  return Object.freeze(n.data);
}

const LOG_DARAJALARI = ["fatal", "error", "warn", "info"] as const;
type LogDaraja = (typeof LOG_DARAJALARI)[number];

function darajaMi(x: string): x is LogDaraja {
  return (LOG_DARAJALARI as readonly string[]).includes(x);
}
const d: LogDaraja = "warn";
console.log(d, darajaMi("info"), darajaMi("verbose"));

warn true false

let config: Config;
try {
  config = configYukla(process.env);
} catch (x) {
  if (!(x instanceof ConfigXatosi)) throw x;
  console.error(x.message);
  process.exit(78); // EX_CONFIG
}

$ PORT=yuz SAQLASH=mongo NODE_ENV=production node src/server.ts
exit 78
Sozlama noto'g'ri:
✖ Noto‘g‘ri kirish: kutilgan raqam, qabul qilingan NaN
  → at PORT
✖ Noto‘g‘ri variant: quyidagilardan biri kutilgan "xotira"|"fayl"
  → at SAQLASH

{"PORT":""} → PORT 0 HSTS false CORS []
{"PORT":" "} → PORT 0 HSTS false CORS []
{"PORT":"3000abc"} → Sozlama noto'g'ri: | ✖ Invalid input: expected number, received NaN |   → at PORT
{"CORS_ORIGINS":"http://localhost:5173/"} → PORT 3000 HSTS false CORS ["http://localhost:5173/"]

CORS_ORIGINS=http://localhost:5173 → 200, Access-Control-Allow-Origin: http://localhost:5173
CORS_ORIGINS=http://localhost:5173/ → 200, Access-Control-Allow-Origin: null

================================
 Invalid environment variables:
    CORS_ORIGIN: Invalid url: "maxfiy-qiymat"
    NODE_ENV: Value "prod" not in choices [development,production,test]
    PORT: Invalid port input: "yuz"
================================

 Exiting with error code 1

❌ Invalid environment variables: [ … message: 'Invalid URL' … ]
tashladi: Error | Invalid environment variables

// config.ts — muhit o'zgaruvchilaridan TIPLI va MUZLATILGAN config
// obyekti. Fail-fast: noto'g'ri sozlama bilan ilova ishga TUSHMAYDI.
// process.env faqat shu faylda o'qiladi — qolgan kod config'ni
// parametr sifatida oladi (testda boshqa qiymat berish oson)
import { z } from "zod";

const Rost = z
  .enum(["true", "false"])
  .transform((x) => x === "true");

const EnvSxemasi = z
  .object({
    NODE_ENV: z
      .enum(["development", "production", "test"])
      .default("development"),
    PORT: z.coerce.number().int().min(0).max(65_535).default(3000),
    // Sukut — faqat lokal: reverse proxy orqasida Node porti
    // tashqariga ochilmasin
    HOST: z.string().min(1).default("127.0.0.1"),
    CORS_ORIGINS: z
      .string()
      .default("")
      .transform((x) =>
        x
          .split(",")
          .map((o) => o.trim())
          .filter((o) => o !== ""),
      )
      .pipe(
        z.array(
          z.url({
            error:
              "CORS_ORIGINS — vergul bilan ajratilgan URL'lar (https://login.github.io)",
          }),
        ),
      ),
    LOG_LEVEL: z
      .enum([
        "fatal",
        "error",
        "warn",
        "info",
        "debug",
        "trace",
        "silent",
      ])
      .default("info"),
    SAQLASH: z.enum(["xotira", "fayl"]).default("xotira"),
    FAYL_YOLI: z.string().min(1).default("data/vazifalar.json"),
    // Express "trust proxy": false | true | proxy'lar soni |
    // "loopback"
    TRUST_PROXY: z
      .string()
      .default("false")
      .transform((x): boolean | number | string =>
        x === "true"
          ? true
          : x === "false"
            ? false
            : /^\d+$/.test(x)
              ? Number(x)
              : x,
      ),
    /**
     * foydalanuvchiga ko'rsatiladigan sana uchun mintaqa; saqlash —
     * doim UTC
     */
    APP_TZ: z
      .string()
      .default("Asia/Tashkent")
      .refine(
        (tz) =>
          Intl.supportedValuesOf("timeZone").includes(tz) ||
          tz === "UTC",
        { error: "APP_TZ — IANA mintaqa (Asia/Tashkent)" },
      ),
    /**
     * vazifa bajarilganda POST yuboriladigan manzil (ixtiyoriy)
     */
    WEBHOOK_URL: z.url().optional(),
    HSTS: Rost.default(false),
  })
  .refine(
    (e) => e.NODE_ENV !== "production" || e.CORS_ORIGINS.length > 0,
    {
      error: "production'da CORS_ORIGINS majburiy",
      path: ["CORS_ORIGINS"],
    },
  );

export type Config = Readonly<z.output<typeof EnvSxemasi>>;

export class ConfigXatosi extends Error {
  constructor(xabar: string) {
    super(xabar);
    this.name = "ConfigXatosi";
  }
}

/** @param env odatda process.env; testda — oddiy obyekt */
export function configYukla(
  env: Record<string, string | undefined>,
): Config {
  const n = EnvSxemasi.safeParse(env);
  // z.prettifyError — odam o'qiydigan ro'yxat (har xato alohida
  // qatorda, "at PORT" bilan). Qiymatlarning o'zi chiqarilmaydi (sir
  // bo'lishi mumkin)
  if (!n.success)
    throw new ConfigXatosi(
      `Sozlama noto'g'ri:\n${z.prettifyError(n.error)}`,
    );
  return Object.freeze(n.data);
}

// server.ts — kirish nuqtasi: config (fail-fast) → ombor → server →
// jarayon hodisalari
// Ishga tushirish: node --env-file-if-exists=.env src/server.ts (npm
// start)
import { configYukla, ConfigXatosi } from "./config.ts";
import { ishgaTushir, omborYarat } from "./ishga-tushir.ts";
import { jarayonniBoshqar } from "./jarayon.ts";
import type { Config } from "./config.ts";

let config: Config;
try {
  config = configYukla(process.env);
} catch (x) {
  if (!(x instanceof ConfigXatosi)) throw x;
  console.error(x.message);
  // EX_CONFIG (sysexits.h) — supervisor qayta-qayta ishga
  // tushirmasin, sozlamani tuzatish kerak
  process.exit(78);
}

const { server, manzil } = await ishgaTushir({
  port: config.PORT,
  host: config.HOST,
  bogliqliklar: {
    ombor: await omborYarat(config),
    corsOriginlar: config.CORS_ORIGINS,
    tz: config.APP_TZ,
    trustProxy: config.TRUST_PROXY,
    hsts: config.HSTS,
  },
});
console.log(
  `vazifalar-api: ${manzil} (${config.NODE_ENV}, saqlash: ${config.SAQLASH})`,
);
jarayonniBoshqar(server, {
  info: (x) => {
    console.log(x);
  },
  fatal: (x, xato) => {
    console.error(x, xato);
  },
});

// ilova.ts — Express ilovasi: middleware tartibi → routerlar → 404 →
// xato ishlovchisi.
// listen() YO'Q — server ishga-tushir.ts da, testlar ilovani portsiz
// ham ishlata oladi
import express from "express";
import cors from "cors";
import helmet from "helmet";
import { join } from "node:path";
import { sorovId } from "./umumiy/sorov-id.ts";
import {
  idempotentlik,
  XotiraIdempotentlikOmbori,
} from "./umumiy/idempotentlik.ts";
import type { IdempotentlikOmbori } from "./umumiy/idempotentlik.ts";
import { JSON_TURLARI } from "./umumiy/json-kerak.ts";
import { eskirgan, ESKI_YOLLAR } from "./umumiy/eskirgan.ts";
import {
  topilmadi,
  xatoIshlovchi,
} from "./umumiy/xato-ishlovchi.ts";
import type { XatoLogi } from "./umumiy/xato-ishlovchi.ts";
import { vazifaXizmati } from "./vazifalar/xizmat.ts";
import {
  teglarRouteri,
  vazifalarRouteri,
} from "./vazifalar/marshrut.ts";
import { eksportRouteri } from "./eksport/eksport.ts";
import type { VazifaOmbori } from "./vazifalar/ombor.ts";

export type Bogliqliklar = {
  ombor: VazifaOmbori;
  /**
   * CORS ruxsat etilgan origin'lar (frontend: Vite dev, Pages) —
   * bo'sh massiv: CORS sarlavhasi yo'q
   */
  corsOriginlar?: readonly string[];
  /** Idempotency-Key javoblari (27-qismda — Redis) */
  idempotentlikOmbori?: IdempotentlikOmbori;
  /**
   * kutilmagan xatolarni yozish (sukut — console.error)
   */
  xatoLogi?: XatoLogi;
  /** foydalanuvchi sanalari mintaqasi (?dan=, ?gacha=) */
  tz?: string;
  /** Express "trust proxy": false — proxy yo'q */
  trustProxy?: boolean | number | string;
  /**
   * HSTS faqat HTTPS orqasida (proxy) yoqiladi — lokal http'da
   * brauzerni chalg'itmasin
   */
  hsts?: boolean;
};

export function ilovaYarat({
  ombor,
  corsOriginlar = [],
  idempotentlikOmbori = new XotiraIdempotentlikOmbori(),
  xatoLogi,
  tz = "Asia/Tashkent",
  trustProxy = false,
  hsts = false,
}: Bogliqliklar): express.Express {
  const app = express();
  app.set("trust proxy", trustProxy);
  app.disable("x-powered-by"); // "Express" ekanini oshkor qilmaymiz
  app.use(sorovId());
  // helmet: nosniff, HSTS, CSP va h.k. — JSON API uchun ham arzon
  // (1 paket, import 2 ms)
  app.use(helmet({ strictTransportSecurity: hsts }));
  // CORS: frontend boshqa origin'dan (GitHub Pages) — faqat
  // ro'yxatdagilar; preflight (OPTIONS) shu yerda javob oladi
  app.use(
    cors({
      origin: [...corsOriginlar],
      allowedHeaders: [
        "Content-Type",
        "Idempotency-Key",
        "X-Request-Id",
        "If-Match",
        "If-None-Match",
      ],
      exposedHeaders: [
        "Location",
        "X-Request-Id",
        "Idempotency-Replayed",
        "ETag",
        "Link",
        "Deprecation",
        "Sunset",
      ],
      maxAge: 600,
    }),
  );
  app.use(
    express.static(join(import.meta.dirname, "..", "public")),
  );
  app.use(express.json({ limit: "16kb", type: JSON_TURLARI }));
  const xizmat = vazifaXizmati(ombor);
  // Versiya URI'da: /v1/... Buzuvchi o'zgarish (maydon nomi, javob
  // shakli) bo'lsa — /v2, v1 bir muddat yashaydi
  const v1 = express.Router();
  v1.use(
    "/vazifalar",
    idempotentlik(idempotentlikOmbori),
    vazifalarRouteri(xizmat, { tz }),
  );
  v1.use("/teglar", teglarRouteri(xizmat));
  v1.use("/eksportlar", eksportRouteri(ombor));
  app.use("/v1", v1);
  // Eski versiyasiz yo'llar (holat 05–24) — ishlaydi, lekin eskirgan:
  // Deprecation + Sunset + vorisga havola
  app.use(eskirgan(ESKI_YOLLAR), v1);
  app.use(topilmadi);
  app.use(xatoIshlovchi(xatoLogi));
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { configYukla, ConfigXatosi } from "../src/config.ts";

test("config: sukut qiymatlar, turlar, muzlatilgan", () => {
  const c = configYukla({});
  assert.equal(c.PORT, 3000);
  assert.equal(c.HOST, "127.0.0.1");
  assert.deepEqual(c.CORS_ORIGINS, []);
  assert.equal(c.SAQLASH, "xotira");
  assert.equal(c.TRUST_PROXY, false);
  assert.equal(c.APP_TZ, "Asia/Tashkent");
  assert.ok(Object.isFrozen(c));
  const d = configYukla({
    PORT: "4100",
    CORS_ORIGINS: "http://localhost:5173, https://login.github.io",
    TRUST_PROXY: "1",
    HSTS: "true",
  });
  assert.equal(d.PORT, 4100);
  assert.deepEqual(d.CORS_ORIGINS, [
    "http://localhost:5173",
    "https://login.github.io",
  ]);
  assert.equal(d.TRUST_PROXY, 1);
  assert.equal(d.HSTS, true);
});

test("config: noto'g'ri qiymat — ConfigXatosi, hammasi bitta xabarda (prettifyError), qiymat oshkor qilinmaydi", () => {
  assert.throws(
    () =>
      configYukla({
        PORT: "yuz",
        SAQLASH: "mongo",
        CORS_ORIGINS: "maxfiy-qiymat",
        APP_TZ: "Toshkent",
      }),
    (x: unknown) => {
      assert.ok(x instanceof ConfigXatosi);
      for (const nom of [
        "PORT",
        "SAQLASH",
        "CORS_ORIGINS",
        "APP_TZ",
      ])
        assert.match(x.message, new RegExp(`at ${nom}`));
      assert.doesNotMatch(x.message, /maxfiy-qiymat/);
      return true;
    },
  );
  assert.throws(
    () => configYukla({ NODE_ENV: "production" }),
    /production'da CORS_ORIGINS majburiy/,
  );
});