julian
7e912e193b
Boots the REAL Fastify app over a fresh in-memory DB (buildServer({ db }), driven by
app.inject — no listen) to exercise the security seam end to end:
- routes.test.ts (7): /health open; login rejects bad creds and sets token+csrf
cookies on good ones; an unauthenticated GET /api/occupancy is 401; a site:read-only
role GETs occupancy but is 403 on PUT /api/site-config (the permission gate, with a
valid CSRF so the 403 is the perm check); an admin passes the same PUT; and a mutation
with the auth cookie but NO csrf header is 403 (double-submit enforced).
Adds seedUser()/login() helpers (real bcrypt + the real /api/auth/login route) and
LOG_LEVEL=silent in the vitest env so asserted 401/403 responses don't flood output.
server 75/75 green (8 suites).
Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
19 lines
793 B
TypeScript
19 lines
793 B
TypeScript
import { defineConfig } from "vitest/config";
|
|
|
|
// Server tests live next to the code under test (src/**/*.test.ts). They run against
|
|
// a fresh in-memory SQLite from @parking/db/testing — never the live parking.sqlite.
|
|
// A test signing key is set here so the SoftwareSigner/buildSigner path works without
|
|
// a real .env (the value is irrelevant — tests assert self-consistency, not secrecy).
|
|
export default defineConfig({
|
|
test: {
|
|
include: ["src/**/*.test.ts"],
|
|
env: {
|
|
EVENT_SIGNING_KEY: "test-event-signing-key-0123456789",
|
|
JWT_SECRET: "test-jwt-secret-0123456789abcdef",
|
|
// Silence the Fastify request logger — route tests assert 401/403 responses,
|
|
// whose error logs would otherwise flood the test output.
|
|
LOG_LEVEL: "silent",
|
|
},
|
|
},
|
|
});
|