OM-560-SEC-A02: modificaciones server.js, README.md y .env.example.

[J-Kanami-PS]

Summary by CodeRabbit

Release Notes

• Documentation

  • Se actualizó la guía de configuración con instrucciones sobre variables de entorno obligatorias.
  • Se agregó nueva sección de Seguridad en la documentación.

• Chores

  • Se mejoró la validación de configuración durante el inicio del servidor para garantizar que todas las variables de entorno necesarias estén correctamente configuradas.

[coderabbitai]

Warning

Review limit reached

@J-Kanami-PS, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 29 minutes and 10 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a1234d18-fe39-4ddc-9c8b-ac945b558c61

📥 Commits

Reviewing files that changed from the base of the PR and between 9e89356 and 558368b.

📒 Files selected for processing (3)

• README.md
• package.json
• src/server.js

📝 Walkthrough

Walkthrough

El PR establece un sistema de validación de variables de entorno al iniciar el servidor. Se define un archivo template .env.example con todas las configuraciones necesarias, se agrega validación en src/server.js, y se documentan los requisitos de seguridad en el README.

Changes

Configuración y Validación de Variables de Entorno

Layer / File(s)	Summary
Environment template and server-side validation \.env\.example, src/server.js	Se define el archivo template .env.example con variables para Supabase, JWT, email, servidor, OpenRouteService y buckets de storage. Se integra validateEnv() en src/server.js para validar estas variables antes de iniciar el servidor.
Security documentation and configuration guide README.md	Se amplia la documentación con una sección Seguridad que explica el manejo de .env, incluye comando para copiar el template, muestra ejemplos de errores por variables faltantes, y documenta una tabla con todas las variables requeridas y sus descripciones.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• leoAchu16
• CrisNAC

Poem

🐰 Las variables del reino, ordenadas con cuidado,
En .env.example quedan documentadas,
El servidor ahora valida sin piedad,
Y el README guía a los aventureros perdidos,
¡La configuración vuela segura hacia el cielo! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	El título describe específicamente los archivos modificados (server.js, README.md y .env.example) y hace referencia al ticket OM-560-SEC-A02, lo que coincide con los cambios principales del PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch OM-560

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 68-92: The README claims the server refuses to start if any of the
listed env vars are missing, but src/config/env.config.js actually validates
only a subset (DATABASE_URL, DIRECT_URL, JWT_SECRET, SUPABASE_URL,
SUPABASE_SERVICE_ROLE_KEY, SUPABASE_BUCKET_PRODUCTS, SUPABASE_BUCKET_USERS,
SUPABASE_BUCKET_STORES); update either the docs or the startup validation:
either remove FRONTEND_URL, EMAIL_HOST/PORT/SECURE/USER/PASS and ORS_API_KEY
from the "Variables requeridas" table in README.md to match the validated keys,
or add those keys to the validation logic in src/config/env.config.js (e.g.,
include FRONTEND_URL, EMAIL_* and ORS_API_KEY in the required keys list and the
existing validation routine) so the documentation and the env validation in
env.config.js are consistent.
- Around line 69-77: El bloque de código y la tabla en README.md están causando
warnings MD040 y MD058; agrega el lenguaje al fenced code block (por ejemplo
```text) y asegúrate de que la tabla (la sección "### Variables requeridas" y la
tabla Markdown que comienza con "| Variable") esté rodeada por una línea en
blanco arriba y otra abajo para cumplir MD058; ajusta el bloque de ejemplo que
muestra "Faltan las siguientes variables de entorno:" para usar ```text y deja
una línea en blanco antes de "### Variables requeridas" y otra después de la
tabla.

In `@src/server.js`:
- Around line 2-7: Move dotenv.config() to run before importing app so
environment variables are loaded prior to any side-effecting imports; remove the
duplicate validateEnv() call from src/server.js or (preferably) remove the
top-level validateEnv() invocation inside src/app.js so validateEnv() is
executed exactly once from server.js after dotenv.config(); ensure references
are to validateEnv(), dotenv.config(), and the top-level import of app to locate
the places to change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c1500373-a921-4efc-8a05-fdab7fee00b9

📥 Commits

Reviewing files that changed from the base of the PR and between ac9dbb6 and 9e89356.

📒 Files selected for processing (3)

• .env.example
• README.md
• src/server.js

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud