Initial commit

tests/config.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest'
+import { loadConfig } from '../src/server/config.js'
+
+const secret = 'test-secret-that-is-at-least-thirty-two-characters'
+
+describe('loadConfig', () => {
+  it('normalizes a valid production origin', () => {
+    expect(
+      loadConfig({
+        NODE_ENV: 'production',
+        APP_SECRET: secret,
+        PUBLIC_ORIGIN: 'https://feedback.example.com/'
+      })
+    ).toMatchObject({
+      nodeEnv: 'production',
+      publicOrigin: 'https://feedback.example.com'
+    })
+  })
+
+  it('requires a production HTTPS origin without paths or credentials', () => {
+    expect(() =>
+      loadConfig({
+        NODE_ENV: 'production',
+        APP_SECRET: secret
+      })
+    ).toThrow()
+    expect(() =>
+      loadConfig({
+        NODE_ENV: 'production',
+        APP_SECRET: secret,
+        PUBLIC_ORIGIN: 'http://feedback.example.com'
+      })
+    ).toThrow()
+    expect(() =>
+      loadConfig({
+        NODE_ENV: 'production',
+        APP_SECRET: secret,
+        PUBLIC_ORIGIN: 'https://feedback.example.com/admin'
+      })
+    ).toThrow()
+  })
+
+  it('rejects the example placeholder secret', () => {
+    expect(() =>
+      loadConfig({
+        APP_SECRET: 'replace-with-at-least-32-random-characters'
+      })
+    ).toThrow()
+  })
+})