metis-desk/apps/server/src/config/env-schema.test.ts

import assert from "node:assert/strict";
import { test } from "node:test";

import { readServerEnvironment } from "./env-schema";

test("el puerto usa un valor local por defecto y acepta los límites válidos", () => {
  assert.equal(readServerEnvironment({}).PORT, 3001);
  assert.equal(readServerEnvironment({ PORT: "1" }).PORT, 1);
  assert.equal(readServerEnvironment({ PORT: "65535" }).PORT, 65535);
});
test("el arranque rechaza puertos inválidos sin revelar el valor recibido", () => {
  for (const port of ["", "0", "-1", "65536", "1.5", "secret-value"]) {
    assert.throws(() => readServerEnvironment({ PORT: port }), {
      message: "Invalid server configuration: PORT must be between 1 and 65535",
    });
  }
});

test("proxy: sin configuración no se confía en cabeceras y producción exige proxies explícitos", () => {
  assert.deepEqual(readServerEnvironment({}).TRUSTED_PROXY_CIDRS, []);
  assert.throws(() => readServerEnvironment({ NODE_ENV: "production" }), /TRUSTED_PROXY_CIDRS/);
  assert.deepEqual(
    readServerEnvironment({
      NODE_ENV: "production",
      TRUSTED_PROXY_CIDRS: "192.0.2.4/32, 2001:db8::4/128",
    }).TRUSTED_PROXY_CIDRS,
    ["192.0.2.4/32", "2001:db8::4/128"]
  );
});

test("proxy: rechaza confianza universal, saltos, alias, hosts y redes inválidas sin revelar valores", () => {
  for (const value of [
    "true",
    "1",
    "loopback",
    "localhost",
    "0.0.0.0/0",
    "::/0",
    "::ffff:0:0/96",
    "192.0.2.4/33",
    "2001:db8::4/129",
    "192.0.2.4,",
    "192.0.2.4/NaN",
    "secret-proxy.example",
  ]) {
    assert.throws(
      () => readServerEnvironment({ TRUSTED_PROXY_CIDRS: value }),
      (error: unknown) => {
        assert.ok(error instanceof Error);
        assert.match(error.message, /TRUSTED_PROXY_CIDRS/);
        assert.equal(error.message.includes(value), false);

        return true;
      }
    );
  }
});