Add PM2 deployment support

tests/config.test.ts

@@ -1,7 +1,17 @@
-import { describe, expect, it } from 'vitest'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
 import { loadConfig } from '../src/server/config.js'
 
 const secret = 'test-secret-that-is-at-least-thirty-two-characters'
+const directories: string[] = []
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
 
 describe('loadConfig', () => {
   it('normalizes a valid production origin', () => {
@@ -40,11 +50,46 @@ describe('loadConfig', () => {
     ).toThrow()
   })
 
-  it('rejects the example placeholder secret', () => {
+  it('accepts an explicitly configured secret without a length restriction', () => {
+    expect(loadConfig({ APP_SECRET: 'short' }).appSecret).toBe('short')
+  })
+
+  it('generates and reuses a secret when APP_SECRET is omitted', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'product-issue-config-'))
+    directories.push(directory)
+
+    const first = loadConfig({ DATA_DIRECTORY: directory })
+    const second = loadConfig({ DATA_DIRECTORY: directory })
+
+    expect(first.appSecret).toHaveLength(43)
+    expect(second.appSecret).toBe(first.appSecret)
+    expect(readFileSync(join(directory, '.app-secret'), 'utf8').trim()).toBe(
+      first.appSecret
+    )
+  })
+
+  it('parses initial administrator configuration', () => {
+    expect(
+      loadConfig({
+        APP_SECRET: secret,
+        INITIAL_ADMIN_EMAIL: 'admin@example.com',
+        INITIAL_ADMIN_PASSWORD: 'a local admin password'
+      }).initialAdmin
+    ).toEqual({
+      email: 'admin@example.com',
+      displayName: 'Administrator',
+      password: 'a local admin password'
+    })
+  })
+
+  it('requires initial administrator email and password together', () => {
     expect(() =>
       loadConfig({
-        APP_SECRET: 'replace-with-at-least-32-random-characters'
+        APP_SECRET: secret,
+        INITIAL_ADMIN_EMAIL: 'admin@example.com'
       })
-    ).toThrow()
+    ).toThrow(
+      'INITIAL_ADMIN_EMAIL and INITIAL_ADMIN_PASSWORD must be configured together'
+    )
   })
 })