
Research
/Security News
Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.
@avanio/variable-util
Advanced tools
getConfigVariable is a utility function that extracts configuration values from different sources like environment variables and even fetches remote configuration values. Also have ability to parse (and verify) string, URL and JSON stringified or semicolon separated object values.
npm i @avanio/variable-util
import {
env,
FetchConfigLoader,
getConfigVariable,
JsonConfigParser,
SemicolonConfigParser,
stringParser,
UrlParser,
ValidateCallback,
} from '@avanio/variable-util';
// example zod schema for the object validation
const objectSchema = z.object({
foo: z.string(),
baz: z.string(),
});
type ObjectSchema = z.infer<typeof objectSchema>;
// And optional object validation callback function
const validate: ValidateCallback<ObjectSchema> = async (data: ObjectSchema) => {
const result = await objectSchema.safeParseAsync(data);
if (!result.success) {
return {success: false, message: result.error.message};
}
return {success: true};
};
// Define the parser instances for the config values
const semicolonConfigParser = new SemicolonConfigParser<ObjectSchema>({validate}); // optional validate callback
const jsonConfigParser = new JsonConfigParser<ObjectSchema>({validate}); // optional validate callback
const urlParser = new UrlParser({urlSanitize: true}); // urlSanitize hides credentials from logs
// optional logger function
setLogger(console); // or log4js instance
// Define the fetch config loader instances and callback to build the request
const callbackToBuildRequest = async (): Promise<Request> => {
return new Request('https://example.com/config.json');
};
const fetchEnv = new FetchConfigLoader(callbackToBuildRequest).getLoader;
// note: fetchEnv can overrider key we are looking for fetchEnv('SOME_OTHER_KEY');
// usually all variables are loaded same way, so you can define the loaders array just once.
const loaders = [reactEnv(), fetchEnv()];
// examples with different loaders and parsers
const valueFromEnv = getConfigVariable('TEST', [env()], stringParser, undefined, {showValue: true});
// valueFromEnv: Promise<string | undefined>
const valueFromReactEnv = getConfigVariable('TEST', [env(), reactEnv()], stringParser, undefined, {showValue: true});
// valueFromReactEnv: Promise<string | undefined>
const valueFromProcessEnv = getConfigVariable('TEST', [env(), reactEnv()], stringParser, undefined, {showValue: true});
// valueFromProcessEnv: Promise<string | undefined>
const valueFromFetch = getConfigVariable('API_SERVER', [reactEnv(), fetchEnv()], urlParser, undefined, {showValue: true});
// valueFromFetch: Promise<URL | undefined>
const valueFromSemicolonConfig = getConfigVariable('TEST', [env()], semicolonConfigParser, undefined, {showValue: true});
// valueFromSemicolonConfig: Promise<ObjectSchema | undefined>
const valueFromJsonConfig = getConfigVariable('TEST', [env()], jsonConfigParser, undefined, {showValue: true});
// valueFromJsonConfig: Promise<ObjectSchema | undefined>
type TestEnv = {
PORT: number;
HOST: string;
DEBUG: boolean;
URL: URL;
};
const config = new ConfigMap<TestEnv>({
DEBUG: {loaders: [env()], parser: booleanParser, defaultValue: false},
HOST: {loaders: [env()], parser: stringParser, defaultValue: 'localhost'},
PORT: {loaders: [env()], parser: integerParser, defaultValue: 3000},
URL: {loaders: [env()], parser: new UrlParser({urlSanitize: true}), defaultValue: new URL('http://localhost:3000')},
});
console.log('port', await config.get('PORT'));
getConfigVariable<Output>(key: string, loaders: ConfigLoader[], parser: ConfigParser, defaultValue?: Output, options?: {showValue?: boolean}): Promise<Output | undefined>
If defaultValue is provided, the function will return the defaultValue if no value is found and type override is applied to function return type.
getConfigVariable<Output>(key: string, loaders: ConfigLoader[], parser: ConfigParser, defaultValue: Output, options?: {showValue?: boolean}): Promise<Output>
env(): IConfigLoaderA IConfigLoader instance that loads configuration values from the process.env.
reactEnv(): IConfigLoaderA IConfigLoader instance that loads configuration values from the process.env. with REACT_APP_* prefix.
new FetchConfigLoader(() => Promise<Response | RequestNotReadyMessage>, options?: FetchConfigLoaderOptions).getLoader: IConfigLoaderA IConfigLoader instance that loads configuration values from a remote source.
Note: getLoader is function generator which can override key we are looking for example, fetchEnv() with default key or fetchEnv('OVERRIDE_KEY')
requestCallback: A function that returns a Promise that resolves to a Response or RequestNotReadyMessage object if the request is not ready yet.(i.e. auth is needed and user is not logged in)
options.fetchClient (optional): A fetch client that can be used to fetch the remote configuration value.
options.isSilent (optional): No throw error if fetch fails. Returns empty object instead.
options.payload (optional): Only 'json' is supported. And default is 'json'.
options.validate (optional): An optional async function that can validate the fetched object to be valid Record<string, string>
options.cache (optional): An optional cache object that can be used to cache the fetched object IRequestCache
see IConfigLoader or extend abstract class ConfigLoader
stringParser(value: string): IConfigParser<string>A function that simply returns the given string value and validates this value to be a string.
integerParser(value: string): IConfigParser<number>A function that simply returns the given string value as integer number and validates this value.
floatParser(value: string): IConfigParser<number>A function that simply returns the given string value as float number and validates this value.
booleanParser(value: string): IConfigParser<boolean>A function that parses the given string value to a boolean and validates this value to be a boolean.
Allowed true values: ['true', '1', 'yes', 'y', 'on']. Allowed false values: ['false', '0', 'no', 'n', 'off'].
new UrlParser(options?: {urlSanitize?: boolean}): IConfigParser<URL>A ConfigParser instance that parses the loaded value to a URL object.
new SemicolonConfigParser<Output>(options?: {validate?: ValidateCallback<Output>, keysToHide?: string[], keepCase = true}): IConfigParser<Output>A SemicolonConfigParser instance that parses semi-colon separated key-value pairs to an object.
example input string: foo=bar;baz=qux output: {foo: 'bar', baz: 'qux'}
new JsonConfigParser<Output>(options?: {validate?: ValidateCallback<Output>, keysToHide?: string[], keepCase = true}): IConfigParser<Output>A JsonConfigParser instance that parses JSON stringified object to an object.
example input string: '{"foo":"bar","baz":"qux"}' output: {foo: 'bar', baz: 'qux'}
FAQs
Utility to get variables from multiple resources
The npm package @avanio/variable-util receives a total of 74 weekly downloads. As such, @avanio/variable-util popularity was classified as not popular.
We found that @avanio/variable-util demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.

Security News
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.

Security News
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain