From 9e87e09d03e9f942e11077bc1993e2df13fa00ed Mon Sep 17 00:00:00 2001
From: jubnl <jgunther021@gmail.com>
Date: Sat, 25 Jul 2026 15:21:17 +0200
Subject: [PATCH] refactor(server): auth, oidc and admin nest modules read env
 via app-config

---
 server/src/nest/admin/admin.controller.ts | 3 ++-
 server/src/nest/auth/auth.controller.ts   | 3 ++-
 server/src/nest/oidc/oidc.controller.ts   | 7 ++++---
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/server/src/nest/admin/admin.controller.ts b/server/src/nest/admin/admin.controller.ts
index f85d01db7..f962fe393 100644
--- a/server/src/nest/admin/admin.controller.ts
+++ b/server/src/nest/admin/admin.controller.ts
@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, HttpCode, HttpException, NotFoundException, Param, Post, Put, Query, Req, UseGuards } from '@nestjs/common';
 import type { Request } from 'express';
+import { readEnv } from '../../app-config';
 import { AdminService } from './admin.service';
 import { PluginRuntimeService } from '../plugins/plugin-runtime.service';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
@@ -345,7 +346,7 @@ export class AdminController {
   @Post('dev/test-notification')
   @HttpCode(200)
   async devTestNotification(@CurrentUser() user: User, @Body() body: { event?: string; scope?: string; targetId?: number; params?: Record<string, unknown>; inApp?: boolean }) {
-    if (process.env.NODE_ENV?.toLowerCase() !== 'development') {
+    if (!readEnv().app.isDevelopment) {
       throw new NotFoundException();
     }
     try {
diff --git a/server/src/nest/auth/auth.controller.ts b/server/src/nest/auth/auth.controller.ts
index 5da251fc4..5c47eace3 100644
--- a/server/src/nest/auth/auth.controller.ts
+++ b/server/src/nest/auth/auth.controller.ts
@@ -20,6 +20,7 @@ import type { Request, Response } from 'express';
 import path from 'path';
 import fs from 'fs';
 import { v4 as uuid } from 'uuid';
+import { readEnv } from '../../app-config';
 import { AuthService } from './auth.service';
 import { RateLimitService } from './rate-limit.service';
 import { JwtAuthGuard } from './jwt-auth.guard';
@@ -132,7 +133,7 @@ export class AuthController {
   @HttpCode(200)
   @UseInterceptors(FileInterceptor('avatar', AVATAR_UPLOAD))
   async avatar(@CurrentUser() user: User, @UploadedFile() file: Express.Multer.File | undefined) {
-    if (process.env.DEMO_MODE?.toLowerCase() === 'true' && isDemoEmail(user.email)) {
+    if (readEnv().demo.enabled && isDemoEmail(user.email)) {
       throw new HttpException({ error: 'Uploads are disabled in demo mode. Self-host TREK for full functionality.' }, 403);
     }
     if (!file) {
diff --git a/server/src/nest/oidc/oidc.controller.ts b/server/src/nest/oidc/oidc.controller.ts
index 2dc6be5ad..f0815d155 100644
--- a/server/src/nest/oidc/oidc.controller.ts
+++ b/server/src/nest/oidc/oidc.controller.ts
@@ -1,5 +1,6 @@
 import { Controller, Get, Query, Req, Res } from '@nestjs/common';
 import type { Request, Response } from 'express';
+import { readEnv } from '../../app-config';
 import { OidcService } from './oidc.service';
 import { cookieOptions } from '../../services/cookie';
 
@@ -29,7 +30,7 @@ export class OidcController {
       res.status(400).json({ error: 'OIDC not configured' });
       return;
     }
-    if (config.issuer && !config.issuer.startsWith('https://') && process.env.NODE_ENV?.toLowerCase() === 'production') {
+    if (config.issuer && !config.issuer.startsWith('https://') && readEnv().app.isProduction) {
       res.status(400).json({ error: 'OIDC issuer must use HTTPS in production' });
       return;
     }
@@ -52,7 +53,7 @@ export class OidcController {
         response_type: 'code',
         client_id: config.clientId,
         redirect_uri: redirectUri,
-        scope: process.env.OIDC_SCOPE || 'openid email profile',
+        scope: readEnv().oidc.scope,
         state,
         code_challenge: codeChallenge,
         code_challenge_method: 'S256',
@@ -93,7 +94,7 @@ export class OidcController {
 
     const config = this.oidc.getOidcConfig();
     if (!config) return f('/login?oidc_error=not_configured');
-    if (config.issuer && !config.issuer.startsWith('https://') && process.env.NODE_ENV?.toLowerCase() === 'production') {
+    if (config.issuer && !config.issuer.startsWith('https://') && readEnv().app.isProduction) {
       return f('/login?oidc_error=issuer_not_https');
     }