From c646fefec142780d90aef89e01a367bad444e69f Mon Sep 17 00:00:00 2001
From: Apher <apher@spilum.net>
Date: Sun, 28 Jun 2026 22:54:03 +0000
Subject: [PATCH] Use config instead of relying on process.env in server.js

---
 src/config/index.js |  5 +++++
 src/server.js       | 19 ++++++++++---------
 2 files changed, 15 insertions(+), 9 deletions(-)
 create mode 100644 src/config/index.js

diff --git a/src/config/index.js b/src/config/index.js
new file mode 100644
index 0000000..c45ca2c
--- /dev/null
+++ b/src/config/index.js
@@ -0,0 +1,5 @@
+module.exports = {
+    force_db_sync: process.env.FORCE_DB_SYNC,
+    node_env: process.env.NODE_ENV,
+    port: process.env.PORT
+};
\ No newline at end of file
diff --git a/src/server.js b/src/server.js
index 14138bf..420d3fc 100644
--- a/src/server.js
+++ b/src/server.js
@@ -1,5 +1,3 @@
-require("dotenv").config();
-
 const express = require("express");
 const cors = require("cors");
 const helmet = require("helmet");
@@ -10,6 +8,9 @@ const db = models.db;
 const {sequelize, Sequelize} = db;
 const Role = db.role;
 
+const authConfig = require("./config/auth.config");
+const config = require("./config");
+
 const createApp = () => {
     const app = express();
 
@@ -18,22 +19,22 @@ const createApp = () => {
 
     // CORS restrict in production (set ALLOWED_ORIGINS env to comma-separated list)
     const corsOptions = {
-        origin: process.env.NODE_ENV === "production"
-        ? (process.env.ALLOWED_ORIGINS || "").split(",").map(s => s.trim())
+        origin: config.NODE_ENV === "production"
+        ? (config.ALLOWED_ORIGINS || "").split(",").map(s => s.trim())
         : true,
         optionsSuccessStatus: 200
     };
     app.use(cors(corsOptions));
 
     // Logging verbose in dev
-    app.use(morgan(process.env.NODE_ENV === "production" ? "combined" : "dev"));
+    app.use(morgan(config.NODE_ENV === "production" ? "combined" : "dev"));
 
     // Body parsing with size limits
     app.use(express.json({limit: "10kb"}));
     app.use(express.urlencoded({extended: false, limit: "10kb"}));
 
     // Apply rate limiting in production
-    if (process.env.NODE_ENV === "production") {
+    if (config.NODE_ENV === "production") {
         app.use(rateLimit({
             windowMs: 15 * 60 * 1000, // 15 minutes
             max: 100, // limit per IP
@@ -74,12 +75,12 @@ const initRoles = async () => {
 const start = async () => {
     try {
         // Validate important env vars
-        if (!process.env.JWT_SECRET) {
+        if (!authConfig.secret) {
             console.warn("JWT_SECRET not set. Ensure secure secret in production.");
         }
 
         // Sync DB (not forced in production)
-        const doForce = process.env.FORCE_DB_SYNC === "true" && process.env.NODE_ENV !== "production";
+        const doForce = config.FORCE_DB_SYNC === "true" && config.NODE_ENV !== "production";
         await sequelize.authenticate();
         await sequelize.sync({force: doForce});
         if (doForce) console.info("Database dropped and resynced (force=true).");
@@ -89,7 +90,7 @@ const start = async () => {
         const app = createApp();
 
         // Set port and listen
-        const PORT = parseInt(process.env.PORT, 10) || 5000;
+        const PORT = parseInt(config.PORT, 10) || 5000;
         const server = app.listen(PORT, () => {
             console.log(`Server listening on port ${PORT}`);
         });