Function validateConfig

apps/worker/src/config-parser.ts:348–399

(config: Config)

}

const validateConfig = (config: Config): void => {
  if (!config || typeof config !== 'object') {
    throw new PentestError(
      'Configuration must be a valid object',
      'config',
      false,
      {},
      ErrorCode.CONFIG_VALIDATION_FAILED,
    );
  }

  if (Array.isArray(config)) {
    throw new PentestError(
      'Configuration must be an object, not an array',
      'config',
      false,
      {},
      ErrorCode.CONFIG_VALIDATION_FAILED,
    );
  }

  checkDeprecatedFields(config);

  const isValid = validateSchema(config);
  if (!isValid) {
    const errors = validateSchema.errors || [];
    const errorMessages = formatAjvErrors(errors);
    throw new PentestError(
      `Configuration validation failed:\n  - ${errorMessages.join('\n  - ')}`,
      'config',
      false,
      { validationErrors: errorMessages },
      ErrorCode.CONFIG_VALIDATION_FAILED,
    );
  }

  performSecurityValidation(config);

  const hasAnySteering =
    !!config.rules ||
    !!config.authentication ||
    !!config.description ||
    !!config.vuln_classes ||
    config.exploit !== undefined ||
    !!config.report ||
    !!config.rules_of_engagement;
  if (!hasAnySteering) {
    console.warn('⚠️  Configuration file contains no steering fields. The pentest will run with all defaults.');
  } else if (config.rules && !config.rules.avoid && !config.rules.focus) {
    console.warn('⚠️  Configuration file contains no rules. The pentest will run without any scoping restrictions.');
  }
};

const performSecurityValidation = (config: Config): void => {
  if (config.authentication) {