From 0c0c66bf0df23ab5a9bd2f147e303d8397d3222e Mon Sep 17 00:00:00 2001
From: Florian Lefebvre <contact@florian-lefebvre.dev>
Date: Wed, 8 Jan 2025 14:29:01 +0100
Subject: [PATCH] feat: improve astro:env config error (#12912)

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
---
 .changeset/curvy-readers-invent.md            |  5 +++++
 packages/astro/src/env/schema.ts              | 19 +++++++++++++++++-
 .../test/units/config/config-validate.test.js | 20 +++++++++++++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/curvy-readers-invent.md

diff --git a/.changeset/curvy-readers-invent.md b/.changeset/curvy-readers-invent.md
new file mode 100644
index 000000000000..c19d9794493d
--- /dev/null
+++ b/.changeset/curvy-readers-invent.md
@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Improves the config error for invalid combinations of `context` and `access` properties under `env.schema`
diff --git a/packages/astro/src/env/schema.ts b/packages/astro/src/env/schema.ts
index 2fc6b003bcd6..f000ec1b9925 100644
--- a/packages/astro/src/env/schema.ts
+++ b/packages/astro/src/env/schema.ts
@@ -75,11 +75,28 @@ const SecretServerEnvFieldMetadata = z.object({
 	context: z.literal('server'),
 	access: z.literal('secret'),
 });
-const EnvFieldMetadata = z.union([
+const _EnvFieldMetadata = z.union([
 	PublicClientEnvFieldMetadata,
 	PublicServerEnvFieldMetadata,
 	SecretServerEnvFieldMetadata,
 ]);
+const EnvFieldMetadata = z.custom<z.input<typeof _EnvFieldMetadata>>().superRefine((data, ctx) => {
+	const result = _EnvFieldMetadata.safeParse(data);
+	if (result.success) {
+		return;
+	}
+	for (const issue of result.error.issues) {
+		if (issue.code === z.ZodIssueCode.invalid_union) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: `**Invalid combination** of "access" and "context" options:\n  Secret client variables are not supported. Please review the configuration of \`env.schema.${ctx.path.at(-1)}\`.\n  Learn more at https://docs.astro.build/en/guides/environment-variables/#variable-types`,
+				path: ['context', 'access'],
+			});
+		} else {
+			ctx.addIssue(issue);
+		}
+	}
+});
 
 const EnvSchemaKey = z
 	.string()
diff --git a/packages/astro/test/units/config/config-validate.test.js b/packages/astro/test/units/config/config-validate.test.js
index 2ef08e4b6a36..cfc52d8a9de1 100644
--- a/packages/astro/test/units/config/config-validate.test.js
+++ b/packages/astro/test/units/config/config-validate.test.js
@@ -406,5 +406,25 @@ describe('Config Validation', () => {
 				'A valid variable name cannot start with a number.',
 			);
 		});
+
+		it('Should provide a useful error for access/context invalid combinations', async () => {
+			const configError = await validateConfig(
+				{
+					env: {
+						schema: {
+							BAR: envField.string({ access: 'secret', context: 'client' }),
+						},
+					},
+				},
+				process.cwd(),
+			).catch((err) => err);
+			assert.equal(configError instanceof z.ZodError, true);
+			assert.equal(
+				configError.errors[0].message.includes(
+					'**Invalid combination** of "access" and "context" options',
+				),
+				true,
+			);
+		});
 	});
 });