s.esmaeiliandCursor
c34bf80e6f
A production API with incomplete config threw before listening, so the container restarted forever and every /api request through nginx was a 502. The problems are now printed as one loud warning and each gets a safe fallback: - JWT_SECRET / JWT_CUSTOMER_SECRET missing, weak or equal: a random key is generated once and kept in the Setting table (boot-secrets.ts), so tokens survive restarts. A strong value in the environment always wins. JwtModule now uses registerAsync so it reads the key after boot fills it. - OTP_MASTER_CODE: ignored in production unless TEST_SERVER_ALLOW_MASTER_CODE=yes. - CORS_ORIGINS: invalid entries dropped; empty allows every origin. Tests: boot-secrets.spec, production-checks.spec. 118 tests pass. سرور با تنظیمات ناقص دیگر مدام ریست نمیشود و ورود دوباره کار میکند. Co-authored-by: Cursor <cursoragent@cursor.com>
63 lines
2.7 KiB
TypeScript
63 lines
2.7 KiB
TypeScript
import { isValidOrigin, masterCodeAllowed, productionConfigProblems } from './production-checks';
|
|
|
|
describe('productionConfigProblems', () => {
|
|
const A = 'a'.repeat(40);
|
|
const C = 'c'.repeat(40);
|
|
const good = {
|
|
NODE_ENV: 'production',
|
|
JWT_SECRET: A,
|
|
JWT_CUSTOMER_SECRET: C,
|
|
CORS_ORIGINS: 'https://adm.example.ir, https://app.example.ir/',
|
|
};
|
|
|
|
it('a complete production config passes', () => {
|
|
expect(productionConfigProblems(good)).toEqual([]);
|
|
});
|
|
|
|
it('checks nothing outside production', () => {
|
|
expect(productionConfigProblems({ NODE_ENV: 'development' })).toEqual([]);
|
|
});
|
|
|
|
it('refuses the fixed test login code (REL-01)', () => {
|
|
expect(productionConfigProblems({ ...good, OTP_MASTER_CODE: '1234' })).toHaveLength(1);
|
|
// explicit opt-in for a test server built from the production image
|
|
expect(
|
|
productionConfigProblems({ ...good, OTP_MASTER_CODE: '1234', TEST_SERVER_ALLOW_MASTER_CODE: 'yes' }),
|
|
).toEqual([]);
|
|
});
|
|
|
|
it('requires a separate customer token key (REL-03)', () => {
|
|
expect(productionConfigProblems({ ...good, JWT_CUSTOMER_SECRET: '' })).toHaveLength(1);
|
|
expect(productionConfigProblems({ ...good, JWT_CUSTOMER_SECRET: A })).toHaveLength(1);
|
|
expect(productionConfigProblems({ ...good, JWT_CUSTOMER_SECRET: 'short' })).toHaveLength(1);
|
|
});
|
|
|
|
it('requires a strong admin key (SEC-04)', () => {
|
|
expect(productionConfigProblems({ ...good, JWT_SECRET: undefined })).toHaveLength(1);
|
|
expect(productionConfigProblems({ ...good, JWT_SECRET: 'dev-only-insecure-secret' })).toHaveLength(1);
|
|
});
|
|
|
|
it('requires an explicit list of allowed origins (SEC-04)', () => {
|
|
expect(productionConfigProblems({ ...good, CORS_ORIGINS: '' })).toHaveLength(1);
|
|
expect(productionConfigProblems({ ...good, CORS_ORIGINS: '*' })).toHaveLength(1);
|
|
expect(productionConfigProblems({ ...good, CORS_ORIGINS: 'adm.example.ir' })).toHaveLength(1);
|
|
});
|
|
|
|
it('lists every problem at once', () => {
|
|
expect(productionConfigProblems({ NODE_ENV: 'production', OTP_MASTER_CODE: '1234' })).toHaveLength(4);
|
|
});
|
|
|
|
it('allows the fixed test login only outside production or with the test-server flag', () => {
|
|
expect(masterCodeAllowed({ NODE_ENV: 'development' })).toBe(true);
|
|
expect(masterCodeAllowed({ NODE_ENV: 'production' })).toBe(false);
|
|
expect(masterCodeAllowed({ NODE_ENV: 'production', TEST_SERVER_ALLOW_MASTER_CODE: 'yes' })).toBe(true);
|
|
});
|
|
|
|
it('accepts only full origins', () => {
|
|
expect(isValidOrigin('https://bnk.example.ir')).toBe(true);
|
|
expect(isValidOrigin('*')).toBe(false);
|
|
expect(isValidOrigin('bnk.example.ir')).toBe(false);
|
|
expect(isValidOrigin('https://bnk.example.ir/app')).toBe(false);
|
|
});
|
|
});
|