fa12df8ec6
Both auth flows now navigate to the app domain rather than the auth.cameleer.io subdomain: PUBLIC_AUTH_SIGNIN_URL → https://app.cameleer.io/sign-in PUBLIC_AUTH_SIGNUP_URL → https://app.cameleer.io/sign-in?first_screen=register Updated: - .env.example (the canonical reference values) - OPERATOR-CHECKLIST.md (deploy-time secret values) - src/config/auth.test.ts (test fixtures) - src/middleware.ts (CSP-comment about <a> navigation target) - src/pages/privacy.astro (visitor-facing external-links section in §6 of the privacy policy) The auth.ts validator stays strict-https — the new URLs are still absolute https URLs, just on a different host. Logto itself may still run at auth.cameleer.io as the OIDC backend; only the visitor-facing /sign-in entry point moved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
63 lines
2.5 KiB
TypeScript
63 lines
2.5 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { resolveAuthConfig } from './auth';
|
|
|
|
describe('resolveAuthConfig', () => {
|
|
it('returns both URLs and sales email from env', () => {
|
|
const cfg = resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNIN_URL: 'https://app.cameleer.io/sign-in',
|
|
PUBLIC_AUTH_SIGNUP_URL: 'https://app.cameleer.io/sign-in?first_screen=register',
|
|
PUBLIC_SALES_EMAIL: 'sales@cameleer.io',
|
|
});
|
|
expect(cfg.signInUrl).toBe('https://app.cameleer.io/sign-in');
|
|
expect(cfg.signUpUrl).toBe('https://app.cameleer.io/sign-in?first_screen=register');
|
|
expect(cfg.salesEmail).toBe('sales@cameleer.io');
|
|
});
|
|
|
|
it('throws if PUBLIC_AUTH_SIGNIN_URL is missing', () => {
|
|
expect(() => resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNUP_URL: 'https://app.cameleer.io/sign-in?first_screen=register',
|
|
PUBLIC_SALES_EMAIL: 'sales@cameleer.io',
|
|
})).toThrow(/PUBLIC_AUTH_SIGNIN_URL/);
|
|
});
|
|
|
|
it('throws if a URL is not https', () => {
|
|
expect(() => resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNIN_URL: 'http://app.cameleer.io/sign-in',
|
|
PUBLIC_AUTH_SIGNUP_URL: 'https://app.cameleer.io/sign-in?first_screen=register',
|
|
PUBLIC_SALES_EMAIL: 'sales@cameleer.io',
|
|
})).toThrow(/must be https/);
|
|
});
|
|
|
|
it('throws if sales email is not a valid mailto target', () => {
|
|
expect(() => resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNIN_URL: 'https://app.cameleer.io/sign-in',
|
|
PUBLIC_AUTH_SIGNUP_URL: 'https://app.cameleer.io/sign-in?first_screen=register',
|
|
PUBLIC_SALES_EMAIL: 'not-an-email',
|
|
})).toThrow(/PUBLIC_SALES_EMAIL/);
|
|
});
|
|
|
|
it('throws if PUBLIC_AUTH_SIGNUP_URL is missing', () => {
|
|
expect(() => resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNIN_URL: 'https://app.cameleer.io/sign-in',
|
|
PUBLIC_SALES_EMAIL: 'sales@cameleer.io',
|
|
})).toThrow(/PUBLIC_AUTH_SIGNUP_URL/);
|
|
});
|
|
|
|
it('throws if PUBLIC_AUTH_SIGNUP_URL is not https', () => {
|
|
expect(() => resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNIN_URL: 'https://app.cameleer.io/sign-in',
|
|
PUBLIC_AUTH_SIGNUP_URL: 'http://app.cameleer.io/sign-in?first_screen=register',
|
|
PUBLIC_SALES_EMAIL: 'sales@cameleer.io',
|
|
})).toThrow(/must be https/);
|
|
});
|
|
|
|
it('exposes signUpUrl distinct from signInUrl', () => {
|
|
const cfg = resolveAuthConfig({
|
|
PUBLIC_AUTH_SIGNIN_URL: 'https://app.cameleer.io/sign-in',
|
|
PUBLIC_AUTH_SIGNUP_URL: 'https://app.cameleer.io/sign-in?first_screen=register',
|
|
PUBLIC_SALES_EMAIL: 'sales@cameleer.io',
|
|
});
|
|
expect(cfg.signUpUrl).not.toBe(cfg.signInUrl);
|
|
});
|
|
});
|