refactor(server): auth, oidc and admin nest modules read env via app-config

server/src/nest/admin/admin.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, HttpCode, HttpException, NotFoundException, Param, Post, Put, Query, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
+import { readEnv } from '../../app-config';
 import { AdminService } from './admin.service';
 import { PluginRuntimeService } from '../plugins/plugin-runtime.service';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
@@ -345,7 +346,7 @@ export class AdminController {
   @Post('dev/test-notification')
   @HttpCode(200)
   async devTestNotification(@CurrentUser() user: User, @Body() body: { event?: string; scope?: string; targetId?: number; params?: Record<string, unknown>; inApp?: boolean }) {
-    if (process.env.NODE_ENV?.toLowerCase() !== 'development') {
+    if (!readEnv().app.isDevelopment) {
       throw new NotFoundException();
     }
     try {

server/src/nest/auth/auth.controller.ts

@@ -20,6 +20,7 @@ import type { Request, Response } from 'express';
 import path from 'path';
 import fs from 'fs';
 import { v4 as uuid } from 'uuid';
+import { readEnv } from '../../app-config';
 import { AuthService } from './auth.service';
 import { RateLimitService } from './rate-limit.service';
 import { JwtAuthGuard } from './jwt-auth.guard';
@@ -132,7 +133,7 @@ export class AuthController {
   @HttpCode(200)
   @UseInterceptors(FileInterceptor('avatar', AVATAR_UPLOAD))
   async avatar(@CurrentUser() user: User, @UploadedFile() file: Express.Multer.File | undefined) {
-    if (process.env.DEMO_MODE?.toLowerCase() === 'true' && isDemoEmail(user.email)) {
+    if (readEnv().demo.enabled && isDemoEmail(user.email)) {
       throw new HttpException({ error: 'Uploads are disabled in demo mode. Self-host TREK for full functionality.' }, 403);
     }
     if (!file) {

server/src/nest/oidc/oidc.controller.ts

@@ -1,5 +1,6 @@
 import { Controller, Get, Query, Req, Res } from '@nestjs/common';
 import type { Request, Response } from 'express';
+import { readEnv } from '../../app-config';
 import { OidcService } from './oidc.service';
 import { cookieOptions } from '../../services/cookie';
 
@@ -29,7 +30,7 @@ export class OidcController {
       res.status(400).json({ error: 'OIDC not configured' });
       return;
     }
-    if (config.issuer && !config.issuer.startsWith('https://') && process.env.NODE_ENV?.toLowerCase() === 'production') {
+    if (config.issuer && !config.issuer.startsWith('https://') && readEnv().app.isProduction) {
       res.status(400).json({ error: 'OIDC issuer must use HTTPS in production' });
       return;
     }
@@ -52,7 +53,7 @@ export class OidcController {
         response_type: 'code',
         client_id: config.clientId,
         redirect_uri: redirectUri,
-        scope: process.env.OIDC_SCOPE || 'openid email profile',
+        scope: readEnv().oidc.scope,
         state,
         code_challenge: codeChallenge,
         code_challenge_method: 'S256',
@@ -93,7 +94,7 @@ export class OidcController {
 
     const config = this.oidc.getOidcConfig();
     if (!config) return f('/login?oidc_error=not_configured');
-    if (config.issuer && !config.issuer.startsWith('https://') && process.env.NODE_ENV?.toLowerCase() === 'production') {
+    if (config.issuer && !config.issuer.startsWith('https://') && readEnv().app.isProduction) {
       return f('/login?oidc_error=issuer_not_https');
     }