Claude
dd639a86f5
Scaffolds the project: Next.js 16 App Router with strict TypeScript, Prisma 7 on PostgreSQL 16, Tailwind 4, Vitest, Playwright, CI, and a standalone Docker image that applies migrations on boot. Makes the no-tracker rule of PLAN.md 3.7 enforceable rather than stated. A per-request nonce-based CSP names no external origin, a unit test fails if any network directive gains one, and a second test fails if a tracking package appears in package.json. The end-to-end test drives the standalone server the Docker image runs, not `next dev`, so a proxy matcher that stopped matching could not pass unnoticed. Environment is validated at import, so a missing DATABASE_URL fails at boot with a readable message instead of surfacing later as a driver error mid-export. ENCRYPTION_KEY is checked to be 32 bytes. Three deviations from the plan, recorded in PLAN.md and README: Next 16 rather than 15, `proxy.ts` rather than the now-deprecated `middleware.ts`, and database-backed sessions rather than Auth.js v5, which is still beta and whose JWTs would make the session revocation required by compliance item 23 awkward. Verified locally against PostgreSQL 16: migrations apply, extensions created, typecheck, lint, 9 unit tests and the end-to-end header test all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
46 lines
1.3 KiB
TypeScript
46 lines
1.3 KiB
TypeScript
import { z } from 'zod';
|
|
|
|
/**
|
|
* Environment contract, validated once at import.
|
|
*
|
|
* A missing DATABASE_URL should fail at boot with a readable message, not
|
|
* surface later as an opaque driver error in the middle of a payroll export.
|
|
*/
|
|
const schema = z.object({
|
|
NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
|
|
|
|
DATABASE_URL: z.url({ protocol: /^postgres(ql)?$/ }),
|
|
|
|
/**
|
|
* Application-level encryption key for the columns PLAN.md §3.6 requires at
|
|
* rest (NIR, IBAN, BIC). 32 bytes, base64. Kept out of the database so a dump
|
|
* alone does not disclose them.
|
|
*/
|
|
ENCRYPTION_KEY: z
|
|
.string()
|
|
.refine(
|
|
(value) => Buffer.from(value, 'base64').length === 32,
|
|
'ENCRYPTION_KEY doit être 32 octets encodés en base64',
|
|
),
|
|
|
|
/** Public origin, used for links in invitation and notification e-mails. */
|
|
APP_URL: z.url().default('http://localhost:3000'),
|
|
});
|
|
|
|
export type Env = z.infer<typeof schema>;
|
|
|
|
function load(): Env {
|
|
const parsed = schema.safeParse(process.env);
|
|
|
|
if (!parsed.success) {
|
|
const details = parsed.error.issues
|
|
.map((issue) => ` - ${issue.path.join('.')}: ${issue.message}`)
|
|
.join('\n');
|
|
throw new Error(`Configuration d'environnement invalide :\n${details}`);
|
|
}
|
|
|
|
return parsed.data;
|
|
}
|
|
|
|
export const env = load();
|