Secrets and Dependencies

// src/payments/payments.service.ts
import { Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';

@Injectable()
export class PaymentsService {
  private readonly apiKey: string;

  constructor(private readonly config: ConfigService) {
    // Shorthand. Throws if the value is undefined, and its return type
    // excludes undefined, so `apiKey` is a string with no narrowing.
    this.apiKey = this.config.getOrThrow<string>('STRIPE_SECRET_KEY');

    // The longhand it replaces - identical behaviour, four more lines:
    //
    //   const apiKey = this.config.get<string>('STRIPE_SECRET_KEY');
    //   if (apiKey === undefined) {
    //     throw new Error('Configuration key STRIPE_SECRET_KEY does not exist');
    //   }
    //   this.apiKey = apiKey;
    //
    // get() returns `T | undefined`, so without the check every use of
    // the value needs a `!` and the missing variable surfaces as a
    // runtime error on the first payment instead of at startup.
  }

  // Resolving configuration in the constructor, not per request, means a
  // missing or malformed value fails while the module is being created.
  async charge(amountInCents: number) {
    // Never log the key, and never put it in an error message: logs and
    // error trackers are read by more people than the deploy pipeline.
    return this.callStripe(amountInCents, this.apiKey);
  }

  private async callStripe(amountInCents: number, apiKey: string) {
    void amountInCents;
    void apiKey;
    throw new Error('not implemented in this example');
  }
}

// src/config/env.validation.ts
// The alternative to validationSchema: a plain synchronous function.
// Useful when validation needs logic a schema cannot express, or when
// you do not want another dependency.

export interface Env {
  NODE_ENV: 'development' | 'test' | 'production';
  PORT: number;
  DATABASE_URL: string;
  JWT_SECRET: string;
}

// Receives the merged variables from .env and the process. Whatever it
// returns is what ConfigService serves, so coercions here take effect.
// If it throws, the application does not bootstrap.
export function validate(config: Record<string, unknown>): Env {
  const errors: string[] = [];

  const nodeEnv = config.NODE_ENV ?? 'development';
  if (nodeEnv !== 'development' && nodeEnv !== 'test' && nodeEnv !== 'production') {
    errors.push(`NODE_ENV: expected development | test | production, got ${String(nodeEnv)}`);
  }

  const port = Number(config.PORT ?? 3000);
  if (!Number.isInteger(port) || port <= 0) {
    errors.push(`PORT: expected a positive integer, got ${String(config.PORT)}`);
  }

  const databaseUrl = String(config.DATABASE_URL ?? '');
  if (!databaseUrl) {
    errors.push('DATABASE_URL: required');
  }

  const jwtSecret = String(config.JWT_SECRET ?? '');
  // A rule a schema would struggle with: the shared development secret
  // must never reach production.
  if (jwtSecret.length < 32 || (nodeEnv === 'production' && jwtSecret === 'dev-secret')) {
    errors.push('JWT_SECRET: at least 32 characters, and not the development default');
  }

  if (errors.length > 0) {
    // The message is printed at startup, so it must not echo the values.
    throw new Error(`Invalid environment:\n${errors.join('\n')}`);
  }

  return {
    NODE_ENV: nodeEnv,
    PORT: port,
    DATABASE_URL: databaseUrl,
    JWT_SECRET: jwtSecret,
  };
}

// src/app.module.ts
// import { validate } from './config/env.validation.js';
//
// @Module({
//   imports: [ConfigModule.forRoot({ isGlobal: true, validate })],
// })
// export class AppModule {}

// src/webhooks/signature.guard.ts
import {
  CanActivate,
  ExecutionContext,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { createHmac, timingSafeEqual } from 'node:crypto';
import type { RawBodyRequest } from '@nestjs/common';
import type { Request } from 'express';

@Injectable()
export class SignatureGuard implements CanActivate {
  private readonly secret: string;

  constructor(config: ConfigService) {
    this.secret = config.getOrThrow<string>('WEBHOOK_SIGNING_SECRET');
  }

  canActivate(context: ExecutionContext): boolean {
    const request = context
      .switchToHttp()
      .getRequest<RawBodyRequest<Request>>();

    // Sign the bytes that arrived, not the re-serialised JSON: key order
    // and whitespace change, and the signature stops matching.
    // req.rawBody needs `rawBody: true` in the NestFactory.create()
    // options, and it is undefined if bodyParser was disabled.
    const raw = request.rawBody;
    const header = request.headers['x-signature'];
    if (!raw || typeof header !== 'string') {
      throw new UnauthorizedException();
    }

    const expected = createHmac('sha256', this.secret).update(raw).digest();
    let received: Buffer;
    try {
      received = Buffer.from(header, 'hex');
    } catch {
      throw new UnauthorizedException();
    }

    // timingSafeEqual throws on a length mismatch, so check first.
    // A plain `===` on the hex strings returns early at the first wrong
    // character, which leaks the correct prefix to a patient caller.
    if (received.length !== expected.length || !timingSafeEqual(received, expected)) {
      throw new UnauthorizedException();
    }

    return true;
  }
}