mirror of
https://github.com/jcreek/LivingDexTracker.git
synced 2026-09-14 17:42:17 +00:00
Josh Creek
92d6460765
The endpoint overrides are read through `$env/dynamic/private`, so they are evaluated per request in production, not baked in at build time. That made a single injected environment variable enough to redirect the authorization-code and refresh-token POSTs - which carry the OAuth client secret and the user's refresh token - to an arbitrary host, and to redirect the user's authorize hop to an arbitrary URL. Overrides are now ignored unless ALLOW_PROVIDER_ENDPOINT_OVERRIDES is exactly "true" and the value is a loopback URL. `npm run test:bdd` sets the flag; nothing else should. resolveProviderEndpoints is pure so the refusals are unit tested, including near-miss hosts such as http://127.0.0.1.example. Also drops the unused `pokedex` parameter from buildCsv rather than silencing it with `void`, and the dead hasGigantamaxed field from its fallback record.
35 lines
873 B
TypeScript
35 lines
873 B
TypeScript
import { defineConfig } from 'vitest/config';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
export default defineConfig({
|
|
resolve: {
|
|
alias: {
|
|
$lib: fileURLToPath(new URL('./src/lib', import.meta.url)),
|
|
'$env/dynamic/private': fileURLToPath(new URL('./tests/support/envStub.ts', import.meta.url))
|
|
}
|
|
},
|
|
test: {
|
|
allowOnly: false,
|
|
include: ['tests/unit/**/*.test.ts', 'tests/data/**/*.test.ts'],
|
|
coverage: {
|
|
provider: 'v8',
|
|
reporter: ['text', 'json-summary', 'html'],
|
|
reportsDirectory: 'coverage',
|
|
include: [
|
|
'src/lib/utils/boxPlacement.ts',
|
|
'src/lib/utils/catchRecordWriteQueue.ts',
|
|
'src/lib/utils/oauthState.ts',
|
|
'src/lib/utils/regionalDexMapping.ts',
|
|
'src/lib/services/PokedexExportFormatting.ts'
|
|
],
|
|
thresholds: {
|
|
perFile: true,
|
|
statements: 90,
|
|
functions: 90,
|
|
lines: 90,
|
|
branches: 80
|
|
}
|
|
}
|
|
}
|
|
});
|