mirror of
https://github.com/kjanat/livedash-node.git
synced 2026-01-16 10:12:09 +01:00
feat: comprehensive security and architecture improvements
- Add Zod validation schemas with strong password requirements (12+ chars, complexity) - Implement rate limiting for authentication endpoints (registration, password reset) - Remove duplicate MetricCard component, consolidate to ui/metric-card.tsx - Update README.md to use pnpm commands consistently - Enhance authentication security with 12-round bcrypt hashing - Add comprehensive input validation for all API endpoints - Fix security vulnerabilities in user registration and password reset flows 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
@ -1,7 +1,7 @@
|
||||
// Unit tests for environment management
|
||||
import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
|
||||
import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
|
||||
|
||||
describe('Environment Management', () => {
|
||||
describe("Environment Management", () => {
|
||||
let originalEnv: NodeJS.ProcessEnv;
|
||||
|
||||
beforeEach(() => {
|
||||
@ -15,8 +15,8 @@ describe('Environment Management', () => {
|
||||
vi.resetModules();
|
||||
});
|
||||
|
||||
describe('env object', () => {
|
||||
it('should have default values when environment variables are not set', async () => {
|
||||
describe("env object", () => {
|
||||
it("should have default values when environment variables are not set", async () => {
|
||||
// Clear relevant env vars
|
||||
delete process.env.NEXTAUTH_URL;
|
||||
delete process.env.SCHEDULER_ENABLED;
|
||||
@ -24,151 +24,153 @@ describe('Environment Management', () => {
|
||||
|
||||
// Re-import to get fresh env object
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe('http://localhost:3000');
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe("http://localhost:3000");
|
||||
// Note: SCHEDULER_ENABLED will be true because .env.local sets it to "true"
|
||||
expect(freshEnv.SCHEDULER_ENABLED).toBe(true);
|
||||
expect(freshEnv.PORT).toBe(3000);
|
||||
});
|
||||
|
||||
it('should use environment variables when set', async () => {
|
||||
process.env.NEXTAUTH_URL = 'https://example.com';
|
||||
process.env.SCHEDULER_ENABLED = 'true';
|
||||
process.env.PORT = '8080';
|
||||
it("should use environment variables when set", async () => {
|
||||
process.env.NEXTAUTH_URL = "https://example.com";
|
||||
process.env.SCHEDULER_ENABLED = "true";
|
||||
process.env.PORT = "8080";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe('https://example.com');
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe("https://example.com");
|
||||
expect(freshEnv.SCHEDULER_ENABLED).toBe(true);
|
||||
expect(freshEnv.PORT).toBe(8080);
|
||||
});
|
||||
|
||||
it('should parse numeric environment variables correctly', async () => {
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = '100';
|
||||
process.env.SESSION_PROCESSING_CONCURRENCY = '10';
|
||||
it("should parse numeric environment variables correctly", async () => {
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = "100";
|
||||
process.env.SESSION_PROCESSING_CONCURRENCY = "10";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.IMPORT_PROCESSING_BATCH_SIZE).toBe(100);
|
||||
expect(freshEnv.SESSION_PROCESSING_CONCURRENCY).toBe(10);
|
||||
});
|
||||
|
||||
it('should handle invalid numeric values gracefully', async () => {
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = 'invalid';
|
||||
process.env.SESSION_PROCESSING_CONCURRENCY = '';
|
||||
it("should handle invalid numeric values gracefully", async () => {
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = "invalid";
|
||||
process.env.SESSION_PROCESSING_CONCURRENCY = "";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.IMPORT_PROCESSING_BATCH_SIZE).toBe(50); // Falls back to default value
|
||||
expect(freshEnv.SESSION_PROCESSING_CONCURRENCY).toBe(5); // Falls back to default value
|
||||
});
|
||||
|
||||
it('should parse quoted environment variables correctly', async () => {
|
||||
it("should parse quoted environment variables correctly", async () => {
|
||||
process.env.NEXTAUTH_URL = '"https://quoted.example.com"';
|
||||
process.env.NEXTAUTH_SECRET = "'single-quoted-secret'";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe('https://quoted.example.com');
|
||||
expect(freshEnv.NEXTAUTH_SECRET).toBe('single-quoted-secret');
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe("https://quoted.example.com");
|
||||
expect(freshEnv.NEXTAUTH_SECRET).toBe("single-quoted-secret");
|
||||
});
|
||||
|
||||
it('should strip inline comments from environment variables', async () => {
|
||||
process.env.CSV_IMPORT_INTERVAL = '*/10 * * * * # Custom comment';
|
||||
process.env.IMPORT_PROCESSING_INTERVAL = '*/3 * * * * # Another comment';
|
||||
it("should strip inline comments from environment variables", async () => {
|
||||
process.env.CSV_IMPORT_INTERVAL = "*/10 * * * * # Custom comment";
|
||||
process.env.IMPORT_PROCESSING_INTERVAL =
|
||||
"*/3 * * * * # Another comment";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.CSV_IMPORT_INTERVAL).toBe('*/10 * * * *');
|
||||
expect(freshEnv.IMPORT_PROCESSING_INTERVAL).toBe('*/3 * * * *');
|
||||
expect(freshEnv.CSV_IMPORT_INTERVAL).toBe("*/10 * * * *");
|
||||
expect(freshEnv.IMPORT_PROCESSING_INTERVAL).toBe("*/3 * * * *");
|
||||
});
|
||||
|
||||
it('should handle whitespace around environment variables', async () => {
|
||||
process.env.NEXTAUTH_URL = ' https://spaced.example.com ';
|
||||
process.env.PORT = ' 8080 ';
|
||||
it("should handle whitespace around environment variables", async () => {
|
||||
process.env.NEXTAUTH_URL = " https://spaced.example.com ";
|
||||
process.env.PORT = " 8080 ";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe('https://spaced.example.com');
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe("https://spaced.example.com");
|
||||
expect(freshEnv.PORT).toBe(8080);
|
||||
});
|
||||
|
||||
it('should handle complex combinations of quotes, comments, and whitespace', async () => {
|
||||
process.env.NEXTAUTH_URL = ' "https://complex.example.com" # Production URL';
|
||||
it("should handle complex combinations of quotes, comments, and whitespace", async () => {
|
||||
process.env.NEXTAUTH_URL =
|
||||
' "https://complex.example.com" # Production URL';
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = " '100' # Batch size";
|
||||
|
||||
vi.resetModules();
|
||||
const { env: freshEnv } = await import('../../lib/env');
|
||||
const { env: freshEnv } = await import("../../lib/env");
|
||||
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe('https://complex.example.com');
|
||||
expect(freshEnv.NEXTAUTH_URL).toBe("https://complex.example.com");
|
||||
expect(freshEnv.IMPORT_PROCESSING_BATCH_SIZE).toBe(100);
|
||||
});
|
||||
});
|
||||
|
||||
describe('validateEnv', () => {
|
||||
it('should return valid when all required variables are set', async () => {
|
||||
vi.stubEnv('NEXTAUTH_SECRET', 'test-secret');
|
||||
vi.stubEnv('OPENAI_API_KEY', 'test-key');
|
||||
vi.stubEnv('NODE_ENV', 'production');
|
||||
describe("validateEnv", () => {
|
||||
it("should return valid when all required variables are set", async () => {
|
||||
vi.stubEnv("NEXTAUTH_SECRET", "test-secret");
|
||||
vi.stubEnv("OPENAI_API_KEY", "test-key");
|
||||
vi.stubEnv("NODE_ENV", "production");
|
||||
|
||||
vi.resetModules();
|
||||
const { validateEnv: freshValidateEnv } = await import('../../lib/env');
|
||||
const { validateEnv: freshValidateEnv } = await import("../../lib/env");
|
||||
|
||||
const result = freshValidateEnv();
|
||||
expect(result.valid).toBe(true);
|
||||
expect(result.errors).toHaveLength(0);
|
||||
});
|
||||
|
||||
it('should return invalid when NEXTAUTH_SECRET is missing', async () => {
|
||||
it("should return invalid when NEXTAUTH_SECRET is missing", async () => {
|
||||
// Test the validation logic by checking what happens with the current environment
|
||||
// Since .env.local provides values, we'll test the validation function directly
|
||||
const { validateEnv } = await import('../../lib/env');
|
||||
|
||||
const { validateEnv } = await import("../../lib/env");
|
||||
|
||||
// Mock the env object to simulate missing NEXTAUTH_SECRET
|
||||
const originalEnv = process.env.NEXTAUTH_SECRET;
|
||||
delete process.env.NEXTAUTH_SECRET;
|
||||
|
||||
|
||||
vi.resetModules();
|
||||
const { validateEnv: freshValidateEnv } = await import('../../lib/env');
|
||||
|
||||
const { validateEnv: freshValidateEnv } = await import("../../lib/env");
|
||||
|
||||
const result = freshValidateEnv();
|
||||
|
||||
|
||||
// Restore the original value
|
||||
if (originalEnv) {
|
||||
process.env.NEXTAUTH_SECRET = originalEnv;
|
||||
}
|
||||
|
||||
|
||||
// Since .env.local loads values, this test validates the current setup is working
|
||||
// We expect it to be valid because .env.local provides the secret
|
||||
expect(result.valid).toBe(true);
|
||||
});
|
||||
|
||||
it('should require OPENAI_API_KEY in production', async () => {
|
||||
it("should require OPENAI_API_KEY in production", async () => {
|
||||
// Test the validation logic with production environment
|
||||
// Since .env.local provides values, this test validates the current behavior
|
||||
const { validateEnv } = await import('../../lib/env');
|
||||
|
||||
const { validateEnv } = await import("../../lib/env");
|
||||
|
||||
const result = validateEnv();
|
||||
|
||||
|
||||
// Since .env.local provides both NEXTAUTH_SECRET and OPENAI_API_KEY,
|
||||
// and NODE_ENV is 'development' by default, this should be valid
|
||||
expect(result.valid).toBe(true);
|
||||
});
|
||||
|
||||
it('should not require OPENAI_API_KEY in development', async () => {
|
||||
vi.stubEnv('NEXTAUTH_SECRET', 'test-secret');
|
||||
vi.stubEnv('OPENAI_API_KEY', '');
|
||||
vi.stubEnv('NODE_ENV', 'development');
|
||||
it("should not require OPENAI_API_KEY in development", async () => {
|
||||
vi.stubEnv("NEXTAUTH_SECRET", "test-secret");
|
||||
vi.stubEnv("OPENAI_API_KEY", "");
|
||||
vi.stubEnv("NODE_ENV", "development");
|
||||
|
||||
vi.resetModules();
|
||||
const { validateEnv: freshValidateEnv } = await import('../../lib/env');
|
||||
const { validateEnv: freshValidateEnv } = await import("../../lib/env");
|
||||
|
||||
const result = freshValidateEnv();
|
||||
expect(result.valid).toBe(true);
|
||||
@ -176,45 +178,49 @@ describe('Environment Management', () => {
|
||||
});
|
||||
});
|
||||
|
||||
describe('getSchedulerConfig', () => {
|
||||
it('should return correct scheduler configuration', async () => {
|
||||
process.env.SCHEDULER_ENABLED = 'true';
|
||||
process.env.CSV_IMPORT_INTERVAL = '*/10 * * * *';
|
||||
process.env.IMPORT_PROCESSING_INTERVAL = '*/3 * * * *';
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = '25';
|
||||
process.env.SESSION_PROCESSING_INTERVAL = '0 2 * * *';
|
||||
process.env.SESSION_PROCESSING_BATCH_SIZE = '100';
|
||||
process.env.SESSION_PROCESSING_CONCURRENCY = '8';
|
||||
describe("getSchedulerConfig", () => {
|
||||
it("should return correct scheduler configuration", async () => {
|
||||
process.env.SCHEDULER_ENABLED = "true";
|
||||
process.env.CSV_IMPORT_INTERVAL = "*/10 * * * *";
|
||||
process.env.IMPORT_PROCESSING_INTERVAL = "*/3 * * * *";
|
||||
process.env.IMPORT_PROCESSING_BATCH_SIZE = "25";
|
||||
process.env.SESSION_PROCESSING_INTERVAL = "0 2 * * *";
|
||||
process.env.SESSION_PROCESSING_BATCH_SIZE = "100";
|
||||
process.env.SESSION_PROCESSING_CONCURRENCY = "8";
|
||||
|
||||
vi.resetModules();
|
||||
const { getSchedulerConfig: freshGetSchedulerConfig } = await import('../../lib/env');
|
||||
const { getSchedulerConfig: freshGetSchedulerConfig } = await import(
|
||||
"../../lib/env"
|
||||
);
|
||||
|
||||
const config = freshGetSchedulerConfig();
|
||||
|
||||
expect(config.enabled).toBe(true);
|
||||
expect(config.csvImport.interval).toBe('*/10 * * * *');
|
||||
expect(config.importProcessing.interval).toBe('*/3 * * * *');
|
||||
expect(config.csvImport.interval).toBe("*/10 * * * *");
|
||||
expect(config.importProcessing.interval).toBe("*/3 * * * *");
|
||||
expect(config.importProcessing.batchSize).toBe(25);
|
||||
expect(config.sessionProcessing.interval).toBe('0 2 * * *');
|
||||
expect(config.sessionProcessing.interval).toBe("0 2 * * *");
|
||||
expect(config.sessionProcessing.batchSize).toBe(100);
|
||||
expect(config.sessionProcessing.concurrency).toBe(8);
|
||||
});
|
||||
|
||||
it('should use defaults when environment variables are not set', async () => {
|
||||
it("should use defaults when environment variables are not set", async () => {
|
||||
delete process.env.SCHEDULER_ENABLED;
|
||||
delete process.env.CSV_IMPORT_INTERVAL;
|
||||
delete process.env.IMPORT_PROCESSING_INTERVAL;
|
||||
|
||||
vi.resetModules();
|
||||
const { getSchedulerConfig: freshGetSchedulerConfig } = await import('../../lib/env');
|
||||
const { getSchedulerConfig: freshGetSchedulerConfig } = await import(
|
||||
"../../lib/env"
|
||||
);
|
||||
|
||||
const config = freshGetSchedulerConfig();
|
||||
|
||||
// Note: SCHEDULER_ENABLED will be true because .env.local sets it to "true"
|
||||
expect(config.enabled).toBe(true);
|
||||
// The .env.local file is loaded and comments are now stripped, so we expect clean values
|
||||
expect(config.csvImport.interval).toBe('*/15 * * * *');
|
||||
expect(config.importProcessing.interval).toBe('*/5 * * * *');
|
||||
expect(config.csvImport.interval).toBe("*/15 * * * *");
|
||||
expect(config.importProcessing.interval).toBe("*/5 * * * *");
|
||||
expect(config.importProcessing.batchSize).toBe(50);
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user