You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Prevent environment variables that are not accounted for in turbo.json from silently bypassing the rule when using a custom environment variable object
Background
There is a somewhat common pattern in TypeScript codebases of validating environment variables with zod, like this:
By using the env object instead of process.env, you get type-safety, editor auto-complete and implicitly ensure the runtime validation happens before any environment variable is being accessed.
However, this pattern isn’t currently compatible with the no-undeclared-env-vars rule in eslint-plugin-turbo, since it only checks direct usage of process.env and import.meta.env. As a result, references like env.API_URL won’t trigger a linting error if API_URL is not listed in turbo.json.
There are workarounds, but they’re either verbose or weaken the validation guarantees this pattern provides:
Adding a global type enhancement for process.env with the type inferred from the zod schema instead of using the exported env object. This makes it harder to guarantee the validation runs before an environment variable is being accessed, since you now have to manually ensure the zod parsing is the very first thing that happens when the app is started
Creating a new object that maps each environment variable in process.env to itself, introducing a usage of process.env.{ENV_VAR} that the ESLint plugin can check, and parsing that object instead of process.env. This is just a lot more verbose, especially when the app uses a lot of environment variables.
Proposal
Add a setting to the no-undeclared-env-vars rule that allows users to specify the name(s) of custom environment variable objects and check them in addition to or instead of process.env and import.meta.env.
Other tools, like Drizzle's ESLint plugin, do something similar by letting users define the name of the Drizzle object used in their codebase to check method calls on this object.
Happy to help contribute if this sounds like something worth adding to the project!
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Goals
no-undeclared-env-varsrule to check custom environment variable objects (e.g.env)turbo.jsonfrom silently bypassing the rule when using a custom environment variable objectBackground
There is a somewhat common pattern in TypeScript codebases of validating environment variables with
zod, like this:By using the
envobject instead ofprocess.env, you get type-safety, editor auto-complete and implicitly ensure the runtime validation happens before any environment variable is being accessed.However, this pattern isn’t currently compatible with the
no-undeclared-env-varsrule ineslint-plugin-turbo, since it only checks direct usage ofprocess.envandimport.meta.env. As a result, references likeenv.API_URLwon’t trigger a linting error ifAPI_URLis not listed inturbo.json.There are workarounds, but they’re either verbose or weaken the validation guarantees this pattern provides:
process.envwith the type inferred from thezodschema instead of using the exportedenvobject. This makes it harder to guarantee the validation runs before an environment variable is being accessed, since you now have to manually ensure thezodparsing is the very first thing that happens when the app is startedprocess.envto itself, introducing a usage ofprocess.env.{ENV_VAR}that the ESLint plugin can check, and parsing that object instead ofprocess.env. This is just a lot more verbose, especially when the app uses a lot of environment variables.Proposal
Add a setting to the
no-undeclared-env-varsrule that allows users to specify the name(s) of custom environment variable objects and check them in addition to or instead ofprocess.envandimport.meta.env.Other tools, like Drizzle's ESLint plugin, do something similar by letting users define the name of the Drizzle object used in their codebase to check method calls on this object.
Happy to help contribute if this sounds like something worth adding to the project!
Beta Was this translation helpful? Give feedback.
All reactions