Initial

server/test/settings.test.mjs

@@ -0,0 +1,38 @@
+import { db, load } from './setup.mjs';
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+const { getSetting, getBooleanSetting, updateSettings, effectiveTrustedOrigins } = await load('../models/settingsModel.js');
+
+test('unpinned settings seed as editable defaults', () => {
+  // No SERVER_FQDN env var is set in the test environment, so server_fqdn is a
+  // default-sourced, admin-editable setting.
+  const source = db.prepare('SELECT source FROM settings WHERE key = ?').get('server_fqdn')?.source;
+  assert.equal(source, 'default');
+});
+
+test('structural settings are env-pinned and locked', () => {
+  const source = db.prepare('SELECT source FROM settings WHERE key = ?').get('database_path')?.source;
+  assert.equal(source, 'env');
+});
+
+test('updateSettings persists editable keys but rejects env-pinned keys', () => {
+  updateSettings({ server_fqdn: 'https://posh.example.com', database_path: '/evil/path.sqlite' });
+  assert.equal(getSetting('server_fqdn'), 'https://posh.example.com');
+  // The env-pinned database_path must be unchanged.
+  assert.notEqual(getSetting('database_path'), '/evil/path.sqlite');
+});
+
+test('allow_script_execution is readable as an effective boolean', () => {
+  updateSettings({ allow_script_execution: 'false' });
+  assert.equal(getBooleanSetting('allow_script_execution', true), false);
+  updateSettings({ allow_script_execution: 'true' });
+  assert.equal(getBooleanSetting('allow_script_execution', false), true);
+});
+
+test('effectiveTrustedOrigins merges admin edits with built-in defaults', () => {
+  updateSettings({ trusted_origins: 'https://ops.example.com' });
+  const origins = effectiveTrustedOrigins();
+  assert.ok(origins.includes('https://ops.example.com'));
+  assert.ok(origins.includes('http://localhost:3000'));
+});