39 lines
1.8 KiB
JavaScript
39 lines
1.8 KiB
JavaScript
import { db, load } from './setup.mjs';
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
|
|
const { getSetting, getBooleanSetting, updateSettings, effectiveTrustedOrigins } = await load('../models/settingsModel.js');
|
|
|
|
test('unpinned settings seed as editable defaults', () => {
|
|
// No SERVER_FQDN env var is set in the test environment, so server_fqdn is a
|
|
// default-sourced, admin-editable setting.
|
|
const source = db.prepare('SELECT source FROM settings WHERE key = ?').get('server_fqdn')?.source;
|
|
assert.equal(source, 'default');
|
|
});
|
|
|
|
test('structural settings are env-pinned and locked', () => {
|
|
const source = db.prepare('SELECT source FROM settings WHERE key = ?').get('database_path')?.source;
|
|
assert.equal(source, 'env');
|
|
});
|
|
|
|
test('updateSettings persists editable keys but rejects env-pinned keys', () => {
|
|
updateSettings({ server_fqdn: 'https://posh.example.com', database_path: '/evil/path.sqlite' });
|
|
assert.equal(getSetting('server_fqdn'), 'https://posh.example.com');
|
|
// The env-pinned database_path must be unchanged.
|
|
assert.notEqual(getSetting('database_path'), '/evil/path.sqlite');
|
|
});
|
|
|
|
test('allow_script_execution is readable as an effective boolean', () => {
|
|
updateSettings({ allow_script_execution: 'false' });
|
|
assert.equal(getBooleanSetting('allow_script_execution', true), false);
|
|
updateSettings({ allow_script_execution: 'true' });
|
|
assert.equal(getBooleanSetting('allow_script_execution', false), true);
|
|
});
|
|
|
|
test('effectiveTrustedOrigins merges admin edits with built-in defaults', () => {
|
|
updateSettings({ trusted_origins: 'https://ops.example.com' });
|
|
const origins = effectiveTrustedOrigins();
|
|
assert.ok(origins.includes('https://ops.example.com'));
|
|
assert.ok(origins.includes('http://localhost:3000'));
|
|
});
|