fix: write X-Request-Id to responses and validate PORT/MAX_ATTACHMENT_BYTES

src/app.ts

@@ -22,10 +22,12 @@ const JSON_BODY_LIMIT = 1 * 1024 * 1024; // 1 MB
 export function createApp(ctx: StackContext, config: Config, logger: Logger): Hono<AppEnv> {
   const app = new Hono<AppEnv>();
 
-  // Assign a unique request ID to every request for log correlation.
+  // Assign a unique request ID to every request and expose it on the response.
   app.use(async (c, next) => {
-    c.set('requestId', crypto.randomUUID());
+    const id = crypto.randomUUID();
+    c.set('requestId', id);
     await next();
+    c.header('X-Request-Id', id);
   });
 
   app.use(

src/config.ts

@@ -1,5 +1,7 @@
 import { existsSync } from 'node:fs';
 
+const DEFAULT_MAX_ATTACHMENT_BYTES = 50 * 1024 * 1024; // 50 MB
+
 function required(name: string): string {
   const val = process.env[name];
   if (!val) throw new Error(`Missing required environment variable: ${name}`);
@@ -35,15 +37,28 @@ export function loadConfig(): Config {
     );
   }
 
+  const port = parseInt(optional('PORT', '3000'), 10);
+  if (isNaN(port) || port < 1 || port > 65535) {
+    throw new Error(`Invalid PORT: ${process.env['PORT']}`);
+  }
+
+  const maxAttachmentBytes = parseInt(
+    optional('MAX_ATTACHMENT_BYTES', String(DEFAULT_MAX_ATTACHMENT_BYTES)),
+    10,
+  );
+  if (isNaN(maxAttachmentBytes) || maxAttachmentBytes < 1) {
+    throw new Error(`Invalid MAX_ATTACHMENT_BYTES: ${process.env['MAX_ATTACHMENT_BYTES']}`);
+  }
+
   return {
-    port: parseInt(optional('PORT', '3000'), 10),
+    port,
     dbPath,
     entityId,
     timezone,
     ownerToken: required('OWNER_TOKEN'),
     corsOrigins: optional('CORS_ORIGINS', ''),
     baseUrl: process.env['BASE_URL'] ?? null,
     isNewDb,
-    maxAttachmentBytes: parseInt(optional('MAX_ATTACHMENT_BYTES', String(50 * 1024 * 1024)), 10),
+    maxAttachmentBytes,
   };
 }