mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 14:06:27 +00:00
Maurice
ba1504d6e9
Eight registerAs tokens existed while every consumer read the same values through readEnv() instead, so the boot-stable layer the repo rules describe was unused and nothing said which path owned a variable. FORCE_HTTPS, for instance, was frozen by the middleware through the http token and read live by the cookie code at the same time. A variable is now owned by exactly one side. TRUST_PROXY and HSTS_INCLUDE_SUBDOMAINS belong to httpConfig, which buildApp() already injects into the pre-init middleware, and TREK_PLACE_PHOTO_DIR to the new storageConfig, which the storage registry now injects instead of reading it through RuntimeEnvService. Their derive functions moved to boot-derive.ts, which deriveAll() never calls. The six tokens nothing injected are gone: their values are needed before the container exists (config.ts, the database, src/mcp, the SSRF guard) and stay on readEnv(). config-ownership.test.ts records the keys each side reads through a Proxy and fails on a variable read through both, on a token nothing injects and on a variable the schema does not validate. env-reference.test.ts holds server/.env.example to the schema, which had drifted by 34 variables (SMTP, WebAuthn, plugins, MCP session tuning, TREK_MANAGED and others); they are documented now. jwt-verify.ts no longer cites a middleware file that is gone.
77 lines
3.0 KiB
TypeScript
77 lines
3.0 KiB
TypeScript
/**
|
|
* AppConfigModule wired into the real buildApp(): boot-stable registerAs
|
|
* snapshots must re-derive on every app build (the env-mutate-then-rebuild
|
|
* pattern the integration suite relies on), and RuntimeEnvService must stay
|
|
* live within a single app's lifetime.
|
|
*/
|
|
import { describe, it, expect, vi, afterEach, beforeAll } from 'vitest';
|
|
import type { INestApplication } from '@nestjs/common';
|
|
|
|
vi.mock('../../src/db/database', async () => {
|
|
const { createSnapshotTestDb, buildDbMock } = await import('../helpers/db-mock');
|
|
return buildDbMock(createSnapshotTestDb());
|
|
});
|
|
vi.mock('../../src/config', () => ({
|
|
JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
|
|
ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
|
|
updateJwtSecret: () => {},
|
|
SESSION_DURATION: '24h',
|
|
SESSION_DURATION_MS: 86400000,
|
|
SESSION_DURATION_SECONDS: 86400,
|
|
DEFAULT_LANGUAGE: 'en',
|
|
}));
|
|
vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));
|
|
|
|
import { db as testDb } from '../../src/db/database';
|
|
import { resetTestDb } from '../helpers/test-db';
|
|
import { buildApp } from '../../src/bootstrap';
|
|
import { httpConfig, RuntimeEnvService } from '../../src/nest/app-config';
|
|
import type { ConfigType } from '@nestjs/config';
|
|
|
|
describe('AppConfigModule in the real buildApp()', () => {
|
|
let app: INestApplication | undefined;
|
|
let prevHsts: string | undefined;
|
|
let prevDemo: string | undefined;
|
|
|
|
beforeAll(() => {
|
|
resetTestDb(testDb);
|
|
prevHsts = process.env.HSTS_INCLUDE_SUBDOMAINS;
|
|
prevDemo = process.env.DEMO_MODE;
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await app?.close();
|
|
app = undefined;
|
|
if (prevHsts === undefined) delete process.env.HSTS_INCLUDE_SUBDOMAINS;
|
|
else process.env.HSTS_INCLUDE_SUBDOMAINS = prevHsts;
|
|
if (prevDemo === undefined) delete process.env.DEMO_MODE;
|
|
else process.env.DEMO_MODE = prevDemo;
|
|
});
|
|
|
|
it('boot-stable snapshots re-derive per app build (mutate → rebuild → new value)', async () => {
|
|
process.env.HSTS_INCLUDE_SUBDOMAINS = 'true';
|
|
app = await buildApp();
|
|
let http = app.get<ConfigType<typeof httpConfig>>(httpConfig.KEY);
|
|
expect(http.hstsIncludeSubdomains).toBe(true);
|
|
await app.close();
|
|
|
|
process.env.HSTS_INCLUDE_SUBDOMAINS = 'off';
|
|
app = await buildApp();
|
|
http = app.get<ConfigType<typeof httpConfig>>(httpConfig.KEY);
|
|
expect(http.hstsIncludeSubdomains).toBe(false);
|
|
});
|
|
|
|
it('a snapshot does NOT move within one app lifetime, RuntimeEnvService does', async () => {
|
|
delete process.env.HSTS_INCLUDE_SUBDOMAINS;
|
|
delete process.env.DEMO_MODE;
|
|
app = await buildApp();
|
|
const http = app.get<ConfigType<typeof httpConfig>>(httpConfig.KEY);
|
|
const runtime = app.get(RuntimeEnvService);
|
|
|
|
process.env.HSTS_INCLUDE_SUBDOMAINS = 'true';
|
|
process.env.DEMO_MODE = 'true';
|
|
expect(http.hstsIncludeSubdomains).toBe(false); // frozen at build, by design
|
|
expect(runtime.isDemoMode()).toBe(true); // live — by design
|
|
});
|
|
});
|