feat: add tbank tokens

src/config/env.validation.ts

@@ -3,6 +3,10 @@ export interface Environment {
   FRONTEND_ORIGIN: string;
   JWT_SECRET: string;
   PORT: number;
+  TOKEN_ENCRYPTION_KEY: string;
+  TBANK_CA_CERT_PATH?: string;
+  TBANK_GRPC_ENDPOINT: string;
+  TBANK_RATE_LIMIT_PER_SECOND: number;
 }
 
 export function validateEnv(config: Record<string, unknown>): Environment {
@@ -10,6 +14,11 @@ export function validateEnv(config: Record<string, unknown>): Environment {
   const frontendOrigin = config['FRONTEND_ORIGIN'];
   const port = config['PORT'] ?? 3000;
   const jwtSecret = config['JWT_SECRET'];
+  const tokenEncryptionKey = config['TOKEN_ENCRYPTION_KEY'];
+  const tbankEndpoint =
+    config['TBANK_GRPC_ENDPOINT'] ?? 'invest-public-api.tbank.ru:443';
+  const tbankRateLimit = config['TBANK_RATE_LIMIT_PER_SECOND'] ?? 5;
+  const tbankCaCertPath = config['TBANK_CA_CERT_PATH'];
 
   if (typeof databaseUrl !== 'string' || !databaseUrl.startsWith('file:')) {
     throw new Error('DATABASE_URL must be a SQLite file URL');
@@ -44,10 +53,39 @@ export function validateEnv(config: Record<string, unknown>): Environment {
     throw new Error('JWT_SECRET must be at least 32 characters long');
   }
 
+  if (
+    typeof tokenEncryptionKey !== 'string' ||
+    !/^[A-Za-z0-9+/]+={0,2}$/.test(tokenEncryptionKey) ||
+    Buffer.from(tokenEncryptionKey, 'base64').length !== 32
+  ) {
+    throw new Error(
+      'TOKEN_ENCRYPTION_KEY must be a base64-encoded 32-byte key',
+    );
+  }
+
+  if (typeof tbankEndpoint !== 'string' || !tbankEndpoint) {
+    throw new Error('TBANK_GRPC_ENDPOINT must be a non-empty endpoint');
+  }
+
+  const parsedTbankRateLimit = Number(tbankRateLimit);
+  if (!Number.isInteger(parsedTbankRateLimit) || parsedTbankRateLimit < 1) {
+    throw new Error('TBANK_RATE_LIMIT_PER_SECOND must be a positive integer');
+  }
+
+  if (tbankCaCertPath !== undefined && typeof tbankCaCertPath !== 'string') {
+    throw new Error('TBANK_CA_CERT_PATH must be a file path');
+  }
+
   return {
     DATABASE_URL: databaseUrl,
     FRONTEND_ORIGIN: parsedOrigin.origin,
     JWT_SECRET: jwtSecret,
     PORT: parsedPort,
+    TOKEN_ENCRYPTION_KEY: tokenEncryptionKey,
+    ...(typeof tbankCaCertPath === 'string' && tbankCaCertPath
+      ? { TBANK_CA_CERT_PATH: tbankCaCertPath }
+      : {}),
+    TBANK_GRPC_ENDPOINT: tbankEndpoint,
+    TBANK_RATE_LIMIT_PER_SECOND: parsedTbankRateLimit,
   };
 }