54 lines
2.0 KiB
TypeScript
54 lines
2.0 KiB
TypeScript
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
|
import { loadConfig } from '../src/config.js';
|
|
|
|
// Guards the CORS_ORIGIN fail-closed contract on the TEAM server config
|
|
// (packages/server/src/config.ts). The team server (index.ts) is the only
|
|
// consumer of config.corsOrigin; the desktop/local server uses the separate
|
|
// hardcoded ALLOWED_ORIGINS allowlist (local/cors-config.ts) and is unaffected.
|
|
describe('loadConfig — CORS_ORIGIN', () => {
|
|
const SAVED = {
|
|
CORS_ORIGIN: process.env.CORS_ORIGIN,
|
|
NODE_ENV: process.env.NODE_ENV,
|
|
DATABASE_URL: process.env.DATABASE_URL,
|
|
};
|
|
|
|
beforeEach(() => {
|
|
delete process.env.CORS_ORIGIN;
|
|
delete process.env.NODE_ENV;
|
|
// DATABASE_URL also fails closed in production; set it so we isolate the
|
|
// CORS_ORIGIN behavior under test.
|
|
process.env.DATABASE_URL = 'postgres://localhost:5434/waggle';
|
|
});
|
|
|
|
afterEach(() => {
|
|
for (const [k, v] of Object.entries(SAVED)) {
|
|
if (v === undefined) delete process.env[k];
|
|
else process.env[k] = v;
|
|
}
|
|
});
|
|
|
|
it('defaults to the localhost dev origin when CORS_ORIGIN is unset (non-production)', () => {
|
|
expect(loadConfig().corsOrigin).toEqual(['http://localhost:5173']);
|
|
});
|
|
|
|
it('FAILS CLOSED in production when CORS_ORIGIN is unset (no silent localhost fallback)', () => {
|
|
process.env.NODE_ENV = 'production';
|
|
expect(() => loadConfig()).toThrow(/CORS_ORIGIN.*required in production/);
|
|
});
|
|
|
|
it('parses a comma-separated list, trimming whitespace and dropping empties', () => {
|
|
process.env.NODE_ENV = 'production';
|
|
process.env.CORS_ORIGIN = 'https://app.example.com, https://admin.example.com ,';
|
|
expect(loadConfig().corsOrigin).toEqual([
|
|
'https://app.example.com',
|
|
'https://admin.example.com',
|
|
]);
|
|
});
|
|
|
|
it('accepts a single explicit origin in production', () => {
|
|
process.env.NODE_ENV = 'production';
|
|
process.env.CORS_ORIGIN = 'https://app.example.com';
|
|
expect(loadConfig().corsOrigin).toEqual(['https://app.example.com']);
|
|
});
|
|
});
|