Summary
Found during fine-grained code-quality review (second pass) at commit 14fbf3e (develop). Severity: medium — bug / operability.
ornn-web/docker-entrypoint.d/40-envsubst-config-js.sh:25 + src/config.ts:80-99 — envsubst substitutes unset env vars to empty strings, and because runtime.x is then "" (not undefined), the ?? fallbacks in config.ts never fire. A deployment missing e.g. NYXID_OAUTH_CLIENT_ID boots a container that looks healthy but has silently broken login — no log line, no failed probe, nothing.
Suggested fix
In the entrypoint, loop over the required var names and exit 1 (or at minimum log loudly) when any is empty; alternatively treat "" as absent in config.ts (|| instead of ?? for required keys).
Summary
Found during fine-grained code-quality review (second pass) at commit
14fbf3e(develop). Severity: medium — bug / operability.ornn-web/docker-entrypoint.d/40-envsubst-config-js.sh:25+src/config.ts:80-99—envsubstsubstitutes unset env vars to empty strings, and becauseruntime.xis then""(notundefined), the??fallbacks inconfig.tsnever fire. A deployment missing e.g.NYXID_OAUTH_CLIENT_IDboots a container that looks healthy but has silently broken login — no log line, no failed probe, nothing.Suggested fix
In the entrypoint, loop over the required var names and
exit 1(or at minimum log loudly) when any is empty; alternatively treat""as absent inconfig.ts(||instead of??for required keys).