test(server): src/config takes fixed test values from the setup file, so suites stop mocking it

tests/setup.ts mocks src/config once with tests/helpers/test-config.ts. A suite that needs other values calls overrideTestConfig(), and the setup file restores the defaults after every case. The 191 per-file factories are gone; config.test.ts takes the real module through vi.unmock, and the few suites that signed tokens with their own literal secret read it from TEST_CONFIG.

server/tests/unit/auto-backup.test.ts

@@ -62,11 +62,6 @@ vi.mock('archiver', () => ({ default: archiverMock }));
 vi.mock('unzipper', () => ({ default: { Extract: vi.fn(), Open: { file: vi.fn() } } }));
 vi.mock('../../src/db/database', () => dbMock);
 vi.mock('../../src/nest/audit/audit-log.logger', () => logMock);
-vi.mock('../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a'.repeat(64),
-  updateJwtSecret: () => {},
-}));
 
 import path from 'node:path';
 import { AutoBackupJob } from '../../src/nest/backup/auto-backup.job';

server/tests/unit/config.test.ts

@@ -2,6 +2,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
+// The subject here is config.ts itself, so this suite takes the real module
+// rather than the fixed values the global setup puts in its place.
+vi.unmock('../../src/config');
+
 // config.ts resolves its key material at import time, so every case here has to
 // reset the module registry and re-import it with the file system stubbed out.
 const ENC_KEY_FILE = path.resolve(__dirname, '../../data/.encryption_key');

server/tests/unit/helpers/test-config.test.ts

@@ -0,0 +1,43 @@
+import * as config from '../../../src/config';
+import { TEST_CONFIG, overrideTestConfig, resetTestConfig } from '../../helpers/test-config';
+
+import { describe, it, expect } from 'vitest';
+
+describe('test config', () => {
+  it('is what src/config answers in every suite', () => {
+    expect(config.JWT_SECRET).toBe('test-jwt-secret-for-trek-testing-only');
+    expect(config.ENCRYPTION_KEY).toBe(TEST_CONFIG.ENCRYPTION_KEY);
+    expect(config.DEFAULT_LANGUAGE).toBe('en');
+    expect(config.SESSION_DURATION_SECONDS).toBe(86400);
+    expect(config.SESSION_DURATION_REMEMBER_MS).toBe(2592000000);
+  });
+
+  it('keeps updateJwtSecret inert, so a rotation in one case does not leak into the next', () => {
+    config.updateJwtSecret('rotated');
+    expect(config.JWT_SECRET).toBe('test-jwt-secret-for-trek-testing-only');
+  });
+
+  it('overrideTestConfig changes what src/config answers until the restore runs', () => {
+    const restore = overrideTestConfig({ JWT_SECRET: 'other-secret', DEFAULT_LANGUAGE: 'de' });
+    expect(config.JWT_SECRET).toBe('other-secret');
+    expect(config.DEFAULT_LANGUAGE).toBe('de');
+    restore();
+    expect(config.JWT_SECRET).toBe('test-jwt-secret-for-trek-testing-only');
+    expect(config.DEFAULT_LANGUAGE).toBe('en');
+  });
+
+  it('leaves an override in place for the rest of its own case', () => {
+    overrideTestConfig({ ENCRYPTION_KEY: 'case-local-key' });
+    expect(config.ENCRYPTION_KEY).toBe('case-local-key');
+  });
+
+  it('starts the next case from the defaults again', () => {
+    expect(config.ENCRYPTION_KEY).toBe('a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2');
+  });
+
+  it('resetTestConfig puts every value back', () => {
+    overrideTestConfig({ SESSION_DURATION_SECONDS: 5 });
+    resetTestConfig();
+    expect(config.SESSION_DURATION_SECONDS).toBe(86400);
+  });
+});

server/tests/unit/mcp/demo-tool-gate.test.ts

@@ -25,11 +25,6 @@ vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 const DEMO_REFUSAL = {

server/tests/unit/mcp/tools-addon-gating.test.ts

@@ -4,21 +4,14 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
 
-
 import { resetTestDb } from '../../helpers/test-db';
 import { createUser, createTrip } from '../../helpers/factories';
 import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';

server/tests/unit/mcp/tools-airtrail.test.ts

@@ -11,16 +11,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-assignments-reservations-extra.test.ts

@@ -5,16 +5,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-assignments.test.ts

@@ -5,16 +5,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-atlas-expanded.test.ts

@@ -7,21 +7,14 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
 
-
 import { resetTestDb } from '../../helpers/test-db';
 import { createUser, createBucketListItem, createVisitedCountry, createTrip, createReservation } from '../../helpers/factories';
 import { createMcpHarness, parseToolResult, parseResourceResult, type McpHarness } from '../../helpers/mcp-harness';

server/tests/unit/mcp/tools-atlas.test.ts

@@ -5,16 +5,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 

server/tests/unit/mcp/tools-budget-advanced.test.ts

@@ -6,16 +6,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-budget.test.ts

@@ -7,16 +7,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-categories.test.ts

@@ -10,16 +10,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { Client } from '@modelcontextprotocol/sdk/client/index';

server/tests/unit/mcp/tools-collab-polls-chat.test.ts

@@ -9,21 +9,14 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
 
-
 import { resetTestDb } from '../../helpers/test-db';
 import { createUser, createTrip } from '../../helpers/factories';
 import { createMcpHarness, parseToolResult, parseResourceResult, type McpHarness } from '../../helpers/mcp-harness';

server/tests/unit/mcp/tools-collections.test.ts

@@ -20,11 +20,6 @@ vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser }));
 const { notifSend } = vi.hoisted(() => ({ notifSend: vi.fn().mockResolvedValue(undefined) }));
 

server/tests/unit/mcp/tools-days-accommodations.test.ts

@@ -9,16 +9,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-days.test.ts

@@ -7,16 +7,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-feeds-invite.test.ts

@@ -10,16 +10,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { resetTestDb } from '../../helpers/test-db';

server/tests/unit/mcp/tools-files.test.ts

@@ -13,16 +13,10 @@ import { db as testDb } from '../../../src/db/database';
 import fs from 'node:fs';
 import nodePath from 'node:path';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-help-addons.test.ts

@@ -5,16 +5,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-journey.test.ts

@@ -6,16 +6,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock, broadcastToUser: broadcastMock }));

server/tests/unit/mcp/tools-leg-transport-mode.test.ts

@@ -5,16 +5,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-memories.test.ts

@@ -10,16 +10,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock, broadcastToUser: broadcastMock }));

server/tests/unit/mcp/tools-notes.test.ts

@@ -8,16 +8,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock, unlinkSyncMock } = vi.hoisted(() => ({
   broadcastMock: vi.fn(),

server/tests/unit/mcp/tools-notifications.test.ts

@@ -12,16 +12,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 

server/tests/unit/mcp/tools-packing-advanced.test.ts

@@ -9,16 +9,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-packing.test.ts

@@ -14,16 +14,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-places.test.ts

@@ -11,16 +11,10 @@ import { DomainError } from '../../../src/nest/common/domain-error';
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-plugin-pois.test.ts

@@ -13,11 +13,6 @@ vi.mock('../../../src/db/database', async () => {
   return buildDbMock(createSnapshotTestDb());
 });
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/plugins/kill-switch', () => ({ pluginsEnabled }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/mcp/tools-plugin-search.test.ts

@@ -5,7 +5,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 const { broadcastMock, pluginsEnabled } = vi.hoisted(() => ({
   broadcastMock: vi.fn(),
   pluginsEnabled: vi.fn(() => true),
@@ -16,11 +15,6 @@ vi.mock('../../../src/db/database', async () => {
   return buildDbMock(createSnapshotTestDb());
 });
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 // The admin kill switch reads live env; drive it from the test instead of the process.
 vi.mock('../../../src/nest/plugins/kill-switch', () => ({ pluginsEnabled }));
 

server/tests/unit/mcp/tools-prompts.test.ts

@@ -22,16 +22,10 @@ import { Client } from '@modelcontextprotocol/sdk/client/index';
 import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory';
 import { ErrorCode } from '@modelcontextprotocol/sdk/types';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
@@ -104,8 +98,6 @@ const readModelStub = {
   getTripSummary: (tripId: number, viewerUserId?: number) => mockGetTripSummary(tripId, viewerUserId),
 } as never;
 
-
-
 // The three remaining prompts moved to their domains' @McpController classes:
 // packing-list, budget-overview and the static-token notice. Built over the same
 // in-memory DB so the cases below keep asserting real rows.

server/tests/unit/mcp/tools-reservations.test.ts

@@ -5,16 +5,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-roadtrip.test.ts

@@ -11,16 +11,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { resetTestDb, setAddonEnabled } from '../../helpers/test-db';

server/tests/unit/mcp/tools-settings.test.ts

@@ -12,16 +12,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 

server/tests/unit/mcp/tools-share.test.ts

@@ -7,16 +7,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { resetTestDb } from '../../helpers/test-db';

server/tests/unit/mcp/tools-tags-maps-weather.test.ts

@@ -7,16 +7,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-todos.test.ts

@@ -11,16 +11,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-transit.test.ts

@@ -7,7 +7,6 @@ import { resetTestDb } from '../../helpers/test-db';
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 const { broadcastMock } = vi.hoisted(() => ({
   broadcastMock: vi.fn(),
 }));
@@ -17,11 +16,6 @@ vi.mock('../../../src/db/database', async () => {
   return buildDbMock(createSnapshotTestDb());
 });
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 import { ReservationsService } from '../../../src/nest/reservations/reservations.service';
 import type { TransitPlace } from '../../../src/nest/transit/transit.helpers';

server/tests/unit/mcp/tools-transports.test.ts

@@ -7,16 +7,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-trip-members.test.ts

@@ -7,16 +7,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-trip-warnings.test.ts

@@ -5,7 +5,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 const { broadcastMock, pluginsEnabled } = vi.hoisted(() => ({
   broadcastMock: vi.fn(),
   pluginsEnabled: vi.fn(() => true),
@@ -16,11 +15,6 @@ vi.mock('../../../src/db/database', async () => {
   return buildDbMock(createSnapshotTestDb());
 });
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 // The admin kill switch reads live env; drive it from the test instead of the process.
 vi.mock('../../../src/nest/plugins/kill-switch', () => ({ pluginsEnabled }));
 

server/tests/unit/mcp/tools-trips.test.ts

@@ -10,16 +10,10 @@
 import { describe, it, expect, vi, beforeAll, beforeEach, afterEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/mcp/tools-vacay.test.ts

@@ -17,16 +17,10 @@ import { DomainError } from '../../../src/nest/common/domain-error';
 import { describe, it, expect, vi, beforeAll, beforeEach, afterEach, afterAll } from 'vitest';
 import { db as testDb } from '../../../src/db/database';
 
-
 vi.mock('../../../src/db/database', async () => {
   const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
   return buildDbMock(createSnapshotTestDb());
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));

server/tests/unit/nest/admin.service.test.ts

@@ -31,15 +31,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  // The session cases sign real session tokens.
-  SESSION_DURATION_SECONDS: 86400,
-  SESSION_DURATION_REMEMBER_SECONDS: 2592000,
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   encrypt_api_key: (v: string) => v,
   decrypt_api_key: (v: string) => v,

server/tests/unit/nest/admin.version-notification.test.ts

@@ -27,12 +27,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcastToUser: vi.fn() }));
 // Mock MCP to avoid session side-effects
 vi.mock('../../../src/mcp', () => ({ revokeUserSessions: vi.fn(), invalidateMcpSessions: vi.fn() }));

server/tests/unit/nest/assignments.service.test.ts

@@ -22,12 +22,6 @@ vi.mock('../../../src/db/database', async () => {
   return { db, closeDb: () => {}, reinitialize: () => {} };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/nest/auth-core/jwt-verify.test.ts

@@ -28,13 +28,12 @@ import {
   verifiedSessionClaims,
   verifyJwtAndLoadUser,
 } from '../../../../src/nest/auth-core/jwt-verify';
+import { TEST_CONFIG } from '../../../helpers/test-config';
 
 import type { Request } from 'express';
 import jwt from 'jsonwebtoken';
 import { describe, it, expect, vi, afterEach } from 'vitest';
 
-vi.mock('../../../../src/config', () => ({ JWT_SECRET: 'test-secret' }));
-
 function makeReq(
   overrides: {
     cookies?: Record<string, string>;
@@ -125,7 +124,7 @@ describe('verifyJwtAndLoadUser', () => {
       role: 'user',
       password_version: 0,
     });
-    const token = jwt.sign({ id: 1 }, 'test-secret', { algorithm: 'HS256' });
+    const token = jwt.sign({ id: 1 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(token, users, sessionsRepo())).toEqual({
       id: 1,
@@ -143,12 +142,16 @@ describe('verifyJwtAndLoadUser', () => {
   it('AUTH-JWT-003: returns null when the user no longer exists', async () => {
     const users = usersRepo(null);
     expect(
-      await verifyJwtAndLoadUser(jwt.sign({ id: 99999 }, 'test-secret', { algorithm: 'HS256' }), users, sessionsRepo()),
+      await verifyJwtAndLoadUser(
+        jwt.sign({ id: 99999 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' }),
+        users,
+        sessionsRepo(),
+      ),
     ).toBeNull();
   });
 
   it('AUTH-JWT-004: returns null for an expired token', async () => {
-    const expired = jwt.sign({ id: 1, exp: Math.floor(Date.now() / 1000) - 3600 }, 'test-secret', {
+    const expired = jwt.sign({ id: 1, exp: Math.floor(Date.now() / 1000) - 3600 }, TEST_CONFIG.JWT_SECRET, {
       algorithm: 'HS256',
     });
     expect(await verifyJwtAndLoadUser(expired, usersRepo(null), sessionsRepo())).toBeNull();
@@ -174,7 +177,7 @@ describe('verifyJwtAndLoadUser', () => {
       role: 'user',
       password_version: 0,
     });
-    const mfaToken = jwt.sign({ id: 1, purpose: 'mfa_login' }, 'test-secret', { algorithm: 'HS256' });
+    const mfaToken = jwt.sign({ id: 1, purpose: 'mfa_login' }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(mfaToken, users, sessionsRepo())).toBeNull();
     expect(users.findByIdWithPasswordVersion).not.toHaveBeenCalled();
@@ -188,7 +191,7 @@ describe('verifyJwtAndLoadUser', () => {
       role: 'user',
       password_version: 2,
     });
-    const stale = jwt.sign({ id: 1, pv: 1 }, 'test-secret', { algorithm: 'HS256' });
+    const stale = jwt.sign({ id: 1, pv: 1 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(stale, users, sessionsRepo())).toBeNull();
   });
@@ -201,7 +204,7 @@ describe('verifyJwtAndLoadUser', () => {
       role: 'user',
       password_version: 2,
     });
-    const current = jwt.sign({ id: 1, pv: 2 }, 'test-secret', { algorithm: 'HS256' });
+    const current = jwt.sign({ id: 1, pv: 2 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(current, users, sessionsRepo())).not.toBeNull();
   });
@@ -218,7 +221,7 @@ describe('verifyJwtAndLoadUser', () => {
       role: 'user',
       password_version: null,
     });
-    const legacy = jwt.sign({ id: 1 }, 'test-secret', { algorithm: 'HS256' });
+    const legacy = jwt.sign({ id: 1 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(legacy, users, sessionsRepo())).not.toBeNull();
   });
@@ -231,7 +234,7 @@ describe('verifyJwtAndLoadUser', () => {
       role: 'user',
       password_version: 1,
     });
-    const legacy = jwt.sign({ id: 1 }, 'test-secret', { algorithm: 'HS256' });
+    const legacy = jwt.sign({ id: 1 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(legacy, users, sessionsRepo())).toBeNull();
   });
@@ -243,7 +246,7 @@ describe('verifyJwtAndLoadUser: the session check', () => {
 
   it('AUTH-JWT-011: a token without a jti is never looked up, so tokens from before the upgrade keep working', async () => {
     const sessions = sessionsRepo();
-    const legacy = jwt.sign({ id: 1, pv: 0 }, 'test-secret', { algorithm: 'HS256' });
+    const legacy = jwt.sign({ id: 1, pv: 0 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(legacy, usersRepo(alice), sessions)).not.toBeNull();
     expect(sessions.findActive).not.toHaveBeenCalled();
@@ -251,7 +254,7 @@ describe('verifyJwtAndLoadUser: the session check', () => {
 
   it('AUTH-JWT-012: a token naming an active session of its own user passes', async () => {
     const sessions = sessionsRepo({ id: SID, last_seen_at: dbNow() });
-    const token = jwt.sign({ id: 1, pv: 0 }, 'test-secret', { algorithm: 'HS256', jwtid: SID });
+    const token = jwt.sign({ id: 1, pv: 0 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: SID });
 
     expect(await verifyJwtAndLoadUser(token, usersRepo(alice), sessions)).toEqual({
       id: 1,
@@ -267,14 +270,14 @@ describe('verifyJwtAndLoadUser: the session check', () => {
   });
 
   it('AUTH-JWT-013: a token whose session is revoked, expired or unknown is refused', async () => {
-    const token = jwt.sign({ id: 1, pv: 0 }, 'test-secret', { algorithm: 'HS256', jwtid: SID });
+    const token = jwt.sign({ id: 1, pv: 0 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: SID });
 
     expect(await verifyJwtAndLoadUser(token, usersRepo(alice), sessionsRepo(null))).toBeNull();
   });
 
   it('AUTH-JWT-014: a jti that is not a string is refused without a lookup', async () => {
     const sessions = sessionsRepo({ id: SID, last_seen_at: dbNow() });
-    const token = jwt.sign({ id: 1, pv: 0, jti: 42 }, 'test-secret', { algorithm: 'HS256' });
+    const token = jwt.sign({ id: 1, pv: 0, jti: 42 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
 
     expect(await verifyJwtAndLoadUser(token, usersRepo(alice), sessions)).toBeNull();
     expect(sessions.findActive).not.toHaveBeenCalled();
@@ -282,7 +285,7 @@ describe('verifyJwtAndLoadUser: the session check', () => {
 
   it('AUTH-JWT-015: the password_version gate runs before the session lookup', async () => {
     const sessions = sessionsRepo({ id: SID, last_seen_at: dbNow() });
-    const stale = jwt.sign({ id: 1, pv: 0 }, 'test-secret', { algorithm: 'HS256', jwtid: SID });
+    const stale = jwt.sign({ id: 1, pv: 0 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: SID });
 
     expect(await verifyJwtAndLoadUser(stale, usersRepo({ ...alice, password_version: 1 }), sessions)).toBeNull();
     expect(sessions.findActive).not.toHaveBeenCalled();
@@ -291,7 +294,7 @@ describe('verifyJwtAndLoadUser: the session check', () => {
   it('AUTH-JWT-016: last_seen_at is refreshed once it is older than the touch interval, not before', async () => {
     vi.useFakeTimers();
     vi.setSystemTime(new Date('2026-10-08T12:00:00Z'));
-    const token = jwt.sign({ id: 1, pv: 0 }, 'test-secret', { algorithm: 'HS256', jwtid: SID });
+    const token = jwt.sign({ id: 1, pv: 0 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: SID });
 
     const fresh = sessionsRepo({ id: SID, last_seen_at: '2026-10-08 11:58:00' });
     expect(await verifyJwtAndLoadUser(token, usersRepo(alice), fresh)).not.toBeNull();
@@ -307,7 +310,7 @@ describe('verifyJwtAndLoadUser: the session check', () => {
     const sessions = sessionsRepo({ id: SID, last_seen_at: '2020-01-01 00:00:00' }, async () => {
       throw new Error('database is locked');
     });
-    const token = jwt.sign({ id: 1, pv: 0 }, 'test-secret', { algorithm: 'HS256', jwtid: SID });
+    const token = jwt.sign({ id: 1, pv: 0 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: SID });
 
     expect(await verifyJwtAndLoadUser(token, usersRepo(alice), sessions)).not.toBeNull();
     expect(sessions.touchLastSeen).toHaveBeenCalled();
@@ -316,31 +319,31 @@ describe('verifyJwtAndLoadUser: the session check', () => {
 
 describe('currentSessionId', () => {
   it('reads the jti of the cookie token', () => {
-    const token = jwt.sign({ id: 1 }, 'test-secret', { algorithm: 'HS256', jwtid: 'sid-1' });
+    const token = jwt.sign({ id: 1 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: 'sid-1' });
     expect(currentSessionId(makeReq({ cookies: { trek_session: token } }))).toBe('sid-1');
   });
 
   it('falls back to the bearer token', () => {
-    const token = jwt.sign({ id: 1 }, 'test-secret', { algorithm: 'HS256', jwtid: 'sid-2' });
+    const token = jwt.sign({ id: 1 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256', jwtid: 'sid-2' });
     expect(currentSessionId(makeReq({ headers: { authorization: `Bearer ${token}` } }))).toBe('sid-2');
   });
 
   it('is undefined for a token without a jti, and without any token', () => {
     expect(
-      currentSessionId(makeReq({ cookies: { trek_session: jwt.sign({ id: 1 }, 'test-secret') } })),
+      currentSessionId(makeReq({ cookies: { trek_session: jwt.sign({ id: 1 }, TEST_CONFIG.JWT_SECRET) } })),
     ).toBeUndefined();
     expect(currentSessionId(makeReq())).toBeUndefined();
   });
 
   it('is undefined for a jti that is not a string', () => {
-    const token = jwt.sign({ id: 1, jti: 7 }, 'test-secret', { algorithm: 'HS256' });
+    const token = jwt.sign({ id: 1, jti: 7 }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' });
     expect(currentSessionId(makeReq({ cookies: { trek_session: token } }))).toBeUndefined();
   });
 });
 
 describe('verifiedSessionClaims', () => {
   it('returns the claims of a well-signed token, even an expired one', () => {
-    const expired = jwt.sign({ id: 3, jti: 'sid', exp: Math.floor(Date.now() / 1000) - 60 }, 'test-secret', {
+    const expired = jwt.sign({ id: 3, jti: 'sid', exp: Math.floor(Date.now() / 1000) - 60 }, TEST_CONFIG.JWT_SECRET, {
       algorithm: 'HS256',
     });
     expect(verifiedSessionClaims(expired)).toEqual(expect.objectContaining({ id: 3, jti: 'sid' }));
@@ -352,9 +355,9 @@ describe('verifiedSessionClaims', () => {
 
   it('refuses a purpose-scoped token and one without a numeric user id', () => {
     expect(
-      verifiedSessionClaims(jwt.sign({ id: 3, purpose: 'mfa_login' }, 'test-secret', { algorithm: 'HS256' })),
+      verifiedSessionClaims(jwt.sign({ id: 3, purpose: 'mfa_login' }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' })),
     ).toBeNull();
-    expect(verifiedSessionClaims(jwt.sign({ id: 'x' }, 'test-secret', { algorithm: 'HS256' }))).toBeNull();
+    expect(verifiedSessionClaims(jwt.sign({ id: 'x' }, TEST_CONFIG.JWT_SECRET, { algorithm: 'HS256' }))).toBeNull();
   });
 
   it('is null without a token', () => {

server/tests/unit/nest/auth.helpers.test.ts

@@ -9,7 +9,6 @@
  */
 import { describe, it, expect, vi } from 'vitest';
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   decrypt_api_key: vi.fn((v) => v),
   maybe_encrypt_api_key: vi.fn((v) => v),

server/tests/unit/nest/auth.service.test.ts

@@ -25,14 +25,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  SESSION_DURATION_SECONDS: 86400,
-  SESSION_DURATION_REMEMBER_SECONDS: 2592000,
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/common/crypto/mfaCrypto', () => ({
   encryptMfaSecret: vi.fn((s) => `enc:${s}`),
   decryptMfaSecret: vi.fn((s: string) => s.replace('enc:', '')),
@@ -50,6 +42,7 @@ vi.mock('../../../src/mcp/sessionManager', () => ({ revokeUserSessions: vi.fn()
 // Imports (after mocks)
 // ---------------------------------------------------------------------------
 
+import { TEST_CONFIG } from '../../helpers/test-config';
 import { asLegacyResult } from '../../helpers/domain-error';
 import { db as testDb } from '../../../src/db/database';
 import { describe, it, expect, beforeAll, beforeEach, afterEach, afterAll, vi } from 'vitest';
@@ -648,7 +641,7 @@ describe('verifyMfaLogin — validation', () => {
   it('AUTH-DB-039: returns 401 when mfa_token has wrong purpose', async () => {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const jwt = require('jsonwebtoken');
-    const tok = jwt.sign({ id: 1, purpose: 'wrong' }, 'test-secret', { expiresIn: '5m', algorithm: 'HS256' });
+    const tok = jwt.sign({ id: 1, purpose: 'wrong' }, TEST_CONFIG.JWT_SECRET, { expiresIn: '5m', algorithm: 'HS256' });
     const result = await asLegacyResult(svc.verifyMfaLogin({ mfa_token: tok, code: '123456' }));
     expect(result.status).toBe(401);
     expect(result.error).toMatch(/invalid/i);
@@ -657,7 +650,7 @@ describe('verifyMfaLogin — validation', () => {
   it('AUTH-DB-040: returns 401 when user not found for valid mfa_token', async () => {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const jwt = require('jsonwebtoken');
-    const tok = jwt.sign({ id: 99999, purpose: 'mfa_login' }, 'test-secret', { expiresIn: '5m', algorithm: 'HS256' });
+    const tok = jwt.sign({ id: 99999, purpose: 'mfa_login' }, TEST_CONFIG.JWT_SECRET, { expiresIn: '5m', algorithm: 'HS256' });
     const result = await asLegacyResult(svc.verifyMfaLogin({ mfa_token: tok, code: '123456' }));
     expect(result.status).toBe(401);
   });
@@ -1190,7 +1183,6 @@ describe('resetPassword', () => {
   });
 });
 
-
 // ---------------------------------------------------------------------------
 // Quirk fixes after the DI fold (trailing fix(server) commit): AUTH-DB-089+.
 // The relocation carried these verbatim; the fixes land on top with a pin each.

server/tests/unit/nest/backup.impl.test.ts

@@ -68,11 +68,6 @@ const logMock = vi.hoisted(() => ({ logInfo: vi.fn(), logError: vi.fn(), logWarn
 
 vi.mock('../../../src/db/database', () => dbMock);
 vi.mock('../../../src/nest/audit/audit-log.logger', () => logMock);
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a'.repeat(64),
-  updateJwtSecret: () => {},
-}));
 vi.mock('fs', () => ({ default: fsMock, ...fsMock }));
 vi.mock('archiver', () => ({ default: archiverMock }));
 vi.mock('unzipper', () => ({ default: unzipperMock }));

server/tests/unit/nest/budget.service.db.test.ts

@@ -17,12 +17,6 @@ vi.mock('../../../src/db/database', async () => {
   return { db, closeDb: () => {}, reinitialize: () => {} };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 // Frozen snapshot of the rates in play in #1543 (rates[X] = units of X per 1 base).

server/tests/unit/nest/calendar.service.test.ts

@@ -22,12 +22,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 const { broadcast } = vi.hoisted(() => ({ broadcast: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast }));
 

server/tests/unit/nest/channel-override.test.ts

@@ -16,7 +16,6 @@ vi.mock('../../../src/db/database', async () => {
     return { db, closeDb: () => {}, reinitialize: () => {}, canAccessTrip: () => null, isOwner: () => false, getPlaceWithTags: () => null };
 });
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'x'.repeat(40), ENCRYPTION_KEY: 'a'.repeat(64), updateJwtSecret: () => {} }));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({ decrypt_api_key: (v: string) => v, maybe_encrypt_api_key: (v: string) => v, encrypt_api_key: (v: string) => v }));
 const { sendMailMock } = vi.hoisted(() => ({ sendMailMock: vi.fn().mockResolvedValue({ accepted: ['a@b.c'] }) }));
 vi.mock('nodemailer', () => ({ default: { createTransport: vi.fn(() => ({ sendMail: sendMailMock, verify: vi.fn() })) } }));

server/tests/unit/nest/collab.service.test.ts

@@ -25,12 +25,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 // Stub checkSsrf so linkPreview tests can control SSRF behaviour. Typed from the real

server/tests/unit/nest/collections.service.test.ts

@@ -26,11 +26,6 @@ const { broadcastToUser } = vi.hoisted(() => ({ broadcastToUser: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';
 
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcastToUser, broadcast: vi.fn() }));
 const notifSend = vi.fn().mockResolvedValue(undefined);
 

server/tests/unit/nest/dawarich-suggestions.service.test.ts

@@ -17,11 +17,6 @@ import { createSnapshotTestDb } from '../../helpers/db-mock';
 
 const testDb = createSnapshotTestDb();
 
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { DAWARICH_BUCKET_SCAN_LIMIT } from '@trek/shared';

server/tests/unit/nest/dawarich.service.test.ts

@@ -47,13 +47,9 @@ import { createSnapshotTestDb } from '../../helpers/db-mock';
 
 const testDb = createSnapshotTestDb();
 
-// Same fixed key the global setup exports, pinned here so the at-rest round
-// trip cannot depend on what is lying in server/data.
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
+// The at-rest round trip uses the fixed key of the global test config
+// (tests/helpers/test-config.ts), so it cannot depend on what is lying in
+// server/data.
 
 // The whole ssrfGuard surface, not only `checkSsrf`: several modules on the
 // import graph pull other names off it, and a factory mock that omits one

server/tests/unit/nest/day-notes.service.test.ts

@@ -21,11 +21,6 @@ vi.mock('../../../src/db/database', async () => {
     getPlaceWithTags: () => null,
   };
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/nest/day-removal.service.test.ts

@@ -14,11 +14,6 @@ vi.mock('../../../src/db/database', async () => {
   // Trip access reads through TripsRepository now; the module only hands out the handle.
   return { db, closeDb: () => {}, reinitialize: () => {} };
 });
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/nest/days.service.test.ts

@@ -22,12 +22,6 @@ vi.mock('../../../src/db/database', async () => {
   return { db, closeDb: () => {}, reinitialize: () => {} };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/nest/files.service.test.ts

@@ -31,11 +31,6 @@ vi.mock('../../../src/db/database', async () => {
 });
 
 import { db as testDb } from '../../../src/db/database';
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
 
 const checkPermission = vi.fn(() => true);

server/tests/unit/nest/immich.service.test.ts

@@ -16,12 +16,6 @@ vi.mock('../../../src/db/database', async () => {
     return { db, closeDb: () => {}, reinitialize: () => {}, canAccessTrip: () => null, isOwner: () => false, getPlaceWithTags: () => null };
 });
 
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'x'.repeat(40),
-  ENCRYPTION_KEY: 'a'.repeat(64),
-  updateJwtSecret: () => {},
-}));
-
 const { decryptMock, maybeEncryptMock } = vi.hoisted(() => ({
   decryptMock: vi.fn((v: string) => v),
   maybeEncryptMock: vi.fn((v: string) => v),

server/tests/unit/nest/journey-book.service.test.ts

@@ -22,12 +22,6 @@ vi.mock('../../../src/db/database', async () => {
     };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcastToUser: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/nest/journey-domain.service.test.ts

@@ -24,12 +24,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcastToUser: vi.fn() }));
 
 import { db as testDb } from '../../../src/db/database';

server/tests/unit/nest/journey-share.service.test.ts

@@ -21,13 +21,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
-
 import { db as testDb } from '../../../src/db/database';
 import { resetTestDb } from '../../helpers/test-db';
 import { createUser, createJourney, createJourneyEntry, addJourneyContributor } from '../../helpers/factories';

server/tests/unit/nest/journey-stats.service.test.ts

@@ -22,12 +22,6 @@ vi.mock('../../../src/db/database', async () => {
     };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/websocket', () => ({ broadcastToUser: vi.fn() }));
 
 /*

server/tests/unit/nest/maps.amap.test.ts

@@ -49,8 +49,6 @@ vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   maybe_encrypt_api_key: (v: string | null) => v,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 // The index answers search and autocomplete before any keyed provider, and
 // trekPlacesEnabled fails open, so a service-level case that reached it with
 // the Amap fetch stub in place would leave the runner for places.liketrek.com.

server/tests/unit/nest/maps.area.test.ts

@@ -15,8 +15,6 @@ vi.mock('../../../src/nest/maps/trek-places.client', async (importOriginal) => (
   trekPlacesArea: mockArea,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { buildMapsService } from '../../helpers/maps-service';
 import type { PlacePhotoCacheService } from '../../../src/nest/place-photos/place-photo-cache.service';
 import { noGoogleQuota } from '../../helpers/google-quota';

server/tests/unit/nest/maps.autocomplete.test.ts

@@ -21,8 +21,6 @@ vi.mock('../../../src/nest/maps/trek-places.client', async (importOriginal) => (
   trekPlacesSearch: mockSearch,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { buildMapsService } from '../../helpers/maps-service';
 import type { PlacePhotoCacheService } from '../../../src/nest/place-photos/place-photo-cache.service';
 import { noGoogleQuota } from '../../helpers/google-quota';
@@ -49,7 +47,6 @@ vi.mock('../../../src/app-config', async (importOriginal) => {
   };
 });
 
-
 const INPUT = 'Café Kröpel';
 
 const hit = (over: Record<string, unknown> = {}) => ({

server/tests/unit/nest/maps.curated-images.test.ts

@@ -15,8 +15,6 @@ vi.mock('../../../src/db/database', () => ({
   db: { prepare: () => ({ get: () => undefined, run: () => undefined, all: () => [] }) },
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 vi.mock('../../../src/utils/ssrfGuard', () => ({
   safeFetchFollow: vi.fn(),
   checkSsrf: vi.fn(async () => ({ allowed: true })),

server/tests/unit/nest/maps.geocode.test.ts

@@ -28,8 +28,6 @@ vi.mock('../../../src/nest/geo/nominatim.client', async (importOriginal) => ({
   nominatimFetch: mockNominatim,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { buildMapsService } from '../../helpers/maps-service';
 import type { PlacePhotoCacheService } from '../../../src/nest/place-photos/place-photo-cache.service';
 import { noGoogleQuota } from '../../helpers/google-quota';

server/tests/unit/nest/maps.gers-details.test.ts

@@ -15,8 +15,6 @@ vi.mock('../../../src/nest/maps/trek-places.client', async (importOriginal) => (
   trekPlacesById: mockById,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { MapsService } from '../../../src/nest/maps/maps.service';
 import { buildMapsParts } from '../../helpers/maps-service';
 import type { OsmClient } from '../../../src/nest/maps/providers/osm.client';

server/tests/unit/nest/maps.google-quota.test.ts

@@ -9,8 +9,6 @@ vi.mock('../../../src/db/database', () => ({
   db: { prepare: () => ({ get: () => undefined, run: () => undefined, all: () => [] }) },
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { GooglePlacesClient } from '../../../src/nest/maps/providers/google-places.provider';
 import { buildMapsService } from '../../helpers/maps-service';
 import { GoogleTransitProvider } from '../../../src/nest/transit/google-transit.provider';

server/tests/unit/nest/maps.identity.test.ts

@@ -11,8 +11,6 @@ vi.mock('../../../src/db/database', () => ({
   db: { prepare: () => ({ get: () => undefined, run: () => undefined, all: () => [] }) },
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 vi.mock('../../../src/utils/ssrfGuard', () => ({
   safeFetchFollow: vi.fn(),
   checkSsrf: vi.fn(async () => ({ allowed: true })),

server/tests/unit/nest/maps.nearby.test.ts

@@ -16,8 +16,6 @@ vi.mock('../../../src/nest/maps/trek-places.client', async (importOriginal) => (
   trekPlacesNearby: mockNearby,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { MapsService } from '../../../src/nest/maps/maps.service';
 import { buildMapsService } from '../../helpers/maps-service';
 import {

server/tests/unit/nest/maps.pois.test.ts

@@ -23,8 +23,6 @@ vi.mock('../../../src/nest/maps/trek-places.client', async (importOriginal) => (
   trekPlacesNearby: mockNearby,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { MapsService } from '../../../src/nest/maps/maps.service';
 import { buildMapsParts } from '../../helpers/maps-service';
 import type { OsmClient } from '../../../src/nest/maps/providers/osm.client';

server/tests/unit/nest/maps.search-merge.test.ts

@@ -28,8 +28,6 @@ vi.mock('../../../src/nest/geo/nominatim.client', async (importOriginal) => ({
   nominatimFetch: mockNominatim,
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { buildMapsService } from '../../helpers/maps-service';
 import type { PlacePhotoCacheService } from '../../../src/nest/place-photos/place-photo-cache.service';
 import { noGoogleQuota } from '../../helpers/google-quota';
@@ -56,7 +54,6 @@ vi.mock('../../../src/app-config', async (importOriginal) => {
   };
 });
 
-
 /** An index row, far enough from the OSM one below not to be deduped. */
 const indexHit = (name: string, lat = 35.31, lng = 139.53) => ({
   gers: name.toLowerCase().replace(/\W/g, ''),

server/tests/unit/nest/maps.service.test.ts

@@ -133,11 +133,6 @@ vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   maybe_encrypt_api_key: (v: string | null) => v,
 }));
 
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: '0'.repeat(64),
-}));
-
 // pois(), searchPlaces() and autocompletePlaces() all ask the index before the
 // old path, and trekPlacesEnabled fails open — so a case that reaches one of
 // them with no fetch stub in place leaves the runner for places.liketrek.com.

server/tests/unit/nest/memories-access.service.test.ts

@@ -21,13 +21,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
-
 const { mockSafeFetch } = vi.hoisted(() => ({
   mockSafeFetch: vi.fn(),
 }));

server/tests/unit/nest/notification-preferences.service.test.ts

@@ -19,12 +19,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   decrypt_api_key: (v: string | null) => v,
   maybe_encrypt_api_key: (v: string) => v,

server/tests/unit/nest/notifications.inapp-prefs.test.ts

@@ -22,13 +22,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
-
 // Mock WebSocket broadcast — must use vi.hoisted() so broadcastMock is available
 // when the vi.mock factory is evaluated (factories are hoisted before const declarations)
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));

server/tests/unit/nest/notifications.service.test.ts

@@ -24,12 +24,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   decrypt_api_key: (v: string | null) => v,
   maybe_encrypt_api_key: (v: string) => v,

server/tests/unit/nest/notifications/push-subscriptions.service.test.ts

@@ -20,11 +20,6 @@ vi.mock('../../../../src/db/database', async () => {
     isOwner: () => false,
   };
 });
-vi.mock('../../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 import { db as testDb } from '../../../../src/db/database';
 import { resetTestDb } from '../../../helpers/test-db';

server/tests/unit/nest/notifications/vapid-keys.service.test.ts

@@ -22,11 +22,6 @@ vi.mock('../../../../src/db/database', async () => {
     isOwner: () => false,
   };
 });
-vi.mock('../../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 const { logInfo, logError } = vi.hoisted(() => ({ logInfo: vi.fn(), logError: vi.fn() }));
 vi.mock('../../../../src/nest/audit/audit-log.logger', () => ({
   LOG_LEVEL: 'error',

server/tests/unit/nest/notifications/web-push-dispatch.test.ts

@@ -21,11 +21,6 @@ vi.mock('../../../../src/db/database', async () => {
     isOwner: () => false,
   };
 });
-vi.mock('../../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 const { safeFetchFollow, logError } = vi.hoisted(() => ({ safeFetchFollow: vi.fn(), logError: vi.fn() }));
 vi.mock('../../../../src/nest/audit/audit-log.logger', () => ({
   LOG_LEVEL: 'error',

server/tests/unit/nest/notifications/web-push.service.test.ts

@@ -21,11 +21,6 @@ vi.mock('../../../../src/db/database', async () => {
     isOwner: () => false,
   };
 });
-vi.mock('../../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 const { logInfo, logError, safeFetchFollow } = vi.hoisted(() => ({
   logInfo: vi.fn(),
   logError: vi.fn(),

server/tests/unit/nest/oauth.service.test.ts

@@ -24,12 +24,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   encrypt_api_key: (v: string) => v,
   decrypt_api_key: (v: string) => v,

server/tests/unit/nest/oidc.service.test.ts

@@ -24,15 +24,6 @@ vi.mock('../../../src/db/database', async () => {
   return { db, closeDb: () => {}, reinitialize: () => {} };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  SESSION_DURATION_SECONDS: 86400,
-  SESSION_DURATION_REMEMBER_SECONDS: 2592000,
-  updateJwtSecret: () => {},
-}));
-
 // Construction insurance for the injected AuthService's import graph (same set
 // as auth.service.test.ts) — TripMembershipService is deliberately the real one,
 // not a stub: OIDC-SVC-045 asserts the actual trip_members row a trip-bound

server/tests/unit/nest/packing.service.test.ts

@@ -26,13 +26,6 @@ vi.mock('../../../src/db/database', async () => {
   return { db, closeDb: () => {}, reinitialize: () => {} };
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
-
 const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
 vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
 

server/tests/unit/nest/passkey.service.test.ts

@@ -34,15 +34,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  SESSION_DURATION_SECONDS: 86400,
-  SESSION_DURATION_REMEMBER_SECONDS: 2592000,
-  updateJwtSecret: () => {},
-}));
-
 // Construction insurance for the injected AuthService's import graph (same set
 // as oidc.service.test.ts / auth.service.test.ts).
 vi.mock('../../../src/nest/common/crypto/mfaCrypto', () => ({

server/tests/unit/nest/photo-resolver.service.test.ts

@@ -17,11 +17,6 @@ vi.mock('../../../src/db/database', async () => {
     return { db, closeDb: () => {}, reinitialize: () => {}, canAccessTrip: () => null, isOwner: () => false, getPlaceWithTags: () => null };
 });
 
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'x'.repeat(40),
-  ENCRYPTION_KEY: 'a'.repeat(64),
-  updateJwtSecret: () => {},
-}));
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   decrypt_api_key: (v: string) => v,
   encrypt_api_key: (v: string) => v,

server/tests/unit/nest/place-enrichment.brand.test.ts

@@ -27,8 +27,6 @@ vi.mock('../../../src/utils/ssrfGuard', () => ({
   SsrfBlockedError: class extends Error {},
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 import { PlaceEnrichmentService } from '../../../src/nest/place-enrichment/place-enrichment.service';
 import { readBrandIdentity } from '../../../src/nest/maps/maps.service';
 import type { MapsService } from '../../../src/nest/maps/maps.service';

server/tests/unit/nest/place-enrichment.description.test.ts

@@ -25,8 +25,6 @@ vi.mock('../../../src/utils/ssrfGuard', () => ({
   SsrfBlockedError: class extends Error {},
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 const { mockTrekPlacesById } = vi.hoisted(() => ({
   mockTrekPlacesById: vi.fn(async (_gers: string): Promise<unknown> => null),
 }));
@@ -397,7 +395,6 @@ describe('filling Google gaps from the free sources', () => {
   });
 })
 
-
 describe("the description on the place's own website", () => {
   // The ordinary case, and the one nothing covered before: a restaurant has no
   // encyclopaedia article and never will, but it does publish a summary of

server/tests/unit/nest/place-enrichment.service.test.ts

@@ -28,8 +28,6 @@ vi.mock('../../../src/utils/ssrfGuard', () => ({
   SsrfBlockedError: class extends Error {},
 }));
 
-vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-secret', ENCRYPTION_KEY: '0'.repeat(64) }));
-
 // Reached for any `gers:` place id, where the real one is an outbound request
 // to the TREK Places API. Only this export is replaced; the record shaping the
 // rest of the module provides stays as it is.

server/tests/unit/nest/places.controller.test.ts

@@ -7,11 +7,6 @@ const { legacyDatabaseAccess } = vi.hoisted(() => ({
   }),
 }));
 
-vi.mock('../../../src/config', () => ({
-  ENCRYPTION_KEY: 'test-only-inert-key',
-  JWT_SECRET: 'test-only-inert-secret',
-  updateJwtSecret: vi.fn(),
-}));
 vi.mock('../../../src/db/database', () => ({
   db: new Proxy({}, {
     get: (_target, property: string | symbol) => legacyDatabaseAccess(property),

server/tests/unit/nest/places.helpers.test.ts

@@ -9,11 +9,6 @@ vi.mock('../../../src/db/database', () => ({
   db: { prepare: vi.fn() },
   getPlaceWithTags: vi.fn(),
 }));
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
 
 import {
   COORD_DEDUP_TOLERANCE,

server/tests/unit/nest/places.service.test.ts

@@ -37,13 +37,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
-
 // Spy on the photo-cache reclaim hook so delete tests assert the wiring without
 // touching disk. The removal logic itself is covered in placePhotoCache.test.ts.
 // Injected stub since the photo-cache fold (was a partial path mock).

server/tests/unit/nest/reminder-jobs.service.test.ts

@@ -15,16 +15,10 @@ vi.mock('../../../src/db/database', async () => {
     return { db, closeDb: () => {}, reinitialize: () => {}, getPlaceWithTags: () => null, canAccessTrip: () => undefined, isOwner: () => false };
 });
 
-
 const logMock = vi.hoisted(() => ({ LOG_LEVEL: 'error', logInfo: vi.fn(), logError: vi.fn(), logWarn: vi.fn(), logDebug: vi.fn() }));
 
 vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));
 vi.mock('../../../src/nest/audit/audit-log.logger', () => logMock);
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a'.repeat(64),
-  updateJwtSecret: () => {},
-}));
 
 import { db as testDb } from '../../../src/db/database';
 import { createUser, createTrip, createTodoItem, setAppSetting, setNotificationChannels } from '../../helpers/factories';

server/tests/unit/nest/session-renewal.interceptor.test.ts

@@ -11,17 +11,6 @@ import type { CallHandler, ExecutionContext } from '@nestjs/common';
 import { of, lastValueFrom } from 'rxjs';
 import jwt from 'jsonwebtoken';
 
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
-  SESSION_DURATION: '24h',
-  SESSION_DURATION_MS: 86400000,
-  SESSION_DURATION_SECONDS: 86400,
-  SESSION_DURATION_REMEMBER: '30d',
-  SESSION_DURATION_REMEMBER_MS: 2592000000,
-  SESSION_DURATION_REMEMBER_SECONDS: 2592000,
-  updateJwtSecret: () => {},
-}));
-
 import { SessionRenewalInterceptor } from '../../../src/nest/auth/session-renewal.interceptor';
 import type { SessionsService } from '../../../src/nest/sessions/sessions.service';
 

server/tests/unit/nest/settings.service.test.ts

@@ -26,13 +26,6 @@ vi.mock('../../../src/db/database', async () => {
     return mock;
 });
 
-
-vi.mock('../../../src/config', () => ({
-  JWT_SECRET: 'test-secret',
-  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
-  updateJwtSecret: () => {},
-}));
-
 // Passthrough crypto — value comes back unchanged for most tests
 vi.mock('../../../src/nest/common/crypto/apiKeyCrypto', () => ({
   maybe_encrypt_api_key: (v: string) => v,