initial commit on Federted servers

internal/config/config_test.go

@@ -0,0 +1,50 @@
+package config
+
+import "testing"
+
+func TestCookieSecureDerivation(t *testing.T) {
+	t.Setenv("COOKIE_SECURE", "")
+	https := &Config{NextAuthURL: "https://app.example.com"}
+	if !https.CookieSecure() {
+		t.Fatal("https NEXTAUTH_URL must imply Secure cookies")
+	}
+	local := &Config{NextAuthURL: "http://localhost:3000"}
+	if local.CookieSecure() {
+		t.Fatal("http NEXTAUTH_URL must not set Secure")
+	}
+	if (&Config{}).CookieSecure() {
+		t.Fatal("unset NEXTAUTH_URL must not set Secure")
+	}
+	t.Setenv("COOKIE_SECURE", "1")
+	if !local.CookieSecure() {
+		t.Fatal("explicit COOKIE_SECURE=1 must win over http URL")
+	}
+	t.Setenv("COOKIE_SECURE", "0")
+	if https.CookieSecure() {
+		t.Fatal("explicit COOKIE_SECURE=0 must win over https URL")
+	}
+}
+
+func TestSecretPrecedence(t *testing.T) {
+	c := &Config{NextAuthSecret: "next", AuthSecret: "auth"}
+	if c.Secret() != "next" {
+		t.Fatal("NEXTAUTH_SECRET must win")
+	}
+	if (&Config{AuthSecret: "auth"}).Secret() != "auth" {
+		t.Fatal("AUTH_SECRET fallback broken")
+	}
+}
+
+// Review OPS-01: a dedicated ENCRYPTION_KEY decouples integration-credential
+// encryption from the session signing secret.
+func TestEncryptionSecretPrecedence(t *testing.T) {
+	c := &Config{AuthSecret: "auth"}
+	t.Setenv("ENCRYPTION_KEY", "")
+	if c.EncryptionSecret() != "auth" {
+		t.Fatal("without ENCRYPTION_KEY the auth secret must remain the key")
+	}
+	t.Setenv("ENCRYPTION_KEY", "dedicated-key")
+	if c.EncryptionSecret() != "dedicated-key" {
+		t.Fatal("ENCRYPTION_KEY must win over the auth secret")
+	}
+}