66 lines
2.4 KiB
JavaScript
66 lines
2.4 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
|
|
import { validateEnvironment } from '../runtime/validate-env.mjs';
|
|
|
|
const validEnv = {
|
|
DOMAIN: 'game.test.invalid',
|
|
ACME_EMAIL: 'admin@test.invalid',
|
|
CORE_REPOSITORY_URL: 'https://git.test.invalid/team/core2026.git',
|
|
POSTGRES_PASSWORD: 'p'.repeat(24),
|
|
REDIS_PASSWORD: 'r'.repeat(24),
|
|
GAME_TOKEN_SECRET: 'g'.repeat(32),
|
|
GATEWAY_BOOTSTRAP_TOKEN: 'b'.repeat(32),
|
|
INITIAL_ADMIN_USERNAME: 'admin',
|
|
INITIAL_ADMIN_PASSWORD: 'a'.repeat(16),
|
|
KAKAO_REST_KEY: 'kakao-test-key',
|
|
};
|
|
|
|
test('accepts a complete public repository environment', () => {
|
|
assert.deepEqual(validateEnvironment(validEnv), []);
|
|
});
|
|
|
|
test('accepts paired HTTPS credentials without embedding them in the URL', () => {
|
|
assert.deepEqual(
|
|
validateEnvironment({ ...validEnv, CORE_REPOSITORY_USERNAME: 'deploy', CORE_REPOSITORY_TOKEN: 'token' }),
|
|
[],
|
|
);
|
|
});
|
|
|
|
test('accepts a paired SSH deploy key and pinned host data', () => {
|
|
assert.deepEqual(
|
|
validateEnvironment({
|
|
...validEnv,
|
|
CORE_REPOSITORY_URL: 'ssh://git@git.test.invalid:2222/team/core2026.git',
|
|
CORE_SSH_PRIVATE_KEY_BASE64: Buffer.from('-----BEGIN OPENSSH PRIVATE KEY-----\ntest\n').toString('base64'),
|
|
CORE_SSH_KNOWN_HOSTS_BASE64: Buffer.from('git.test.invalid ssh-ed25519 test\n').toString('base64'),
|
|
}),
|
|
[],
|
|
);
|
|
});
|
|
|
|
test('rejects placeholders, weak secrets, and partial credentials', () => {
|
|
const errors = validateEnvironment({
|
|
...validEnv,
|
|
DOMAIN: 'game.example.com',
|
|
POSTGRES_PASSWORD: 'short',
|
|
CORE_REPOSITORY_USERNAME: 'deploy',
|
|
});
|
|
assert.ok(errors.some((error) => error.includes('DOMAIN still contains')));
|
|
assert.ok(errors.some((error) => error.includes('POSTGRES_PASSWORD must contain')));
|
|
assert.ok(errors.some((error) => error.includes('must be set together')));
|
|
});
|
|
|
|
test('rejects credentials embedded in repository URLs and mixed auth modes', () => {
|
|
const errors = validateEnvironment({
|
|
...validEnv,
|
|
CORE_REPOSITORY_URL: 'https://deploy:secret@git.test.invalid/team/core2026.git',
|
|
CORE_REPOSITORY_USERNAME: 'deploy',
|
|
CORE_REPOSITORY_TOKEN: 'token',
|
|
CORE_SSH_PRIVATE_KEY_BASE64: 'key',
|
|
CORE_SSH_KNOWN_HOSTS_BASE64: 'hosts',
|
|
});
|
|
assert.ok(errors.some((error) => error.includes('must not embed credentials')));
|
|
assert.ok(errors.some((error) => error.includes('only one Core repository authentication mode')));
|
|
});
|