refactor: 리펙토링

tests/runtime-schema/runtime-config.test.ts

@@ -6,17 +6,22 @@ import { assertSafeConfigNames } from "../../src/contracts/env.ts";
 
 const validConfig = {
   APP_ENV: "local",
-  API_BASE_URL: "http://localhost:8080",
+  API_BASE_URL: "http://localhost:8080/",
   REQUEST_TIMEOUT_MS: 10_000,
   MAX_RETRY_ATTEMPTS: 2,
   TELEMETRY_ENABLED: false,
   AUTH_MODE: "external",
-  CONFIG_SCHEMA_VERSION: "1",
-  API_CONTRACT_VERSION: "1",
+  CONFIG_SCHEMA_VERSION: "2.0",
   RELEASE_MANIFEST_URL: "/release-manifest.json",
   BUILD_ID: "build-a",
 };
 
+const validV1Config = {
+  ...validConfig,
+  CONFIG_SCHEMA_VERSION: "1",
+  API_CONTRACT_VERSION: "1.4.0",
+};
+
 describe("runtime configuration boundary", () => {
   it.each([
     [{ ...validConfig, API_BASE_URL: undefined }, "required key"],
@@ -24,6 +29,30 @@ describe("runtime configuration boundary", () => {
     [{ ...validConfig, MAX_RETRY_ATTEMPTS: 3 }, "retry cap"],
     [{ ...validConfig, TELEMETRY_ENABLED: "false" }, "ambiguous boolean"],
     [{ ...validConfig, CONFIG_SCHEMA_VERSION: "next" }, "version"],
+    [
+      { ...validConfig, API_CONTRACT_VERSION: "1" },
+      "§5.1 scalar contract version is removed from V2",
+    ],
+    [
+      { ...validConfig, API_BASE_URL: "http://localhost:8080/api" },
+      "§6.2 base URL path must end with /",
+    ],
+    [
+      { ...validConfig, API_BASE_URL: "http://localhost:8080/#frag" },
+      "§6.2 hash in base URL",
+    ],
+    [
+      { ...validConfig, API_BASE_URL: "http://user:pw@localhost:8080/" },
+      "§6.2 credentials in URL",
+    ],
+    [
+      { ...validConfig, RELEASE_MANIFEST_URL: "/a/../b.json" },
+      "§6.2 dot segment traversal",
+    ],
+    [
+      { ...validConfig, RELEASE_MANIFEST_URL: "/manifest.json?v=1" },
+      "§6.2 query in manifest URL",
+    ],
     [{ ...validConfig, UNKNOWN_KEY: true }, "unknown key"],
   ])("rejects invalid config: %s (%s)", (candidate, _reason) => {
     void _reason;
@@ -44,12 +73,55 @@ describe("runtime configuration boundary", () => {
       validateRuntimeConfig({
         ...validConfig,
         APP_ENV: "production",
-        API_BASE_URL: "https://api.example.test",
+        API_BASE_URL: "https://api.example.test/",
         AUTH_MODE: "demo",
       }).success,
     ).toBe(false);
   });
 
+  it("accepts only the explicitly supported V1 and V2 boot versions", () => {
+    expect(validateRuntimeConfig(validV1Config)).toMatchObject({
+      success: true,
+      schema: "V1",
+    });
+    expect(validateRuntimeConfig(validConfig)).toMatchObject({
+      success: true,
+      schema: "V2",
+    });
+
+    for (const version of ["0", "1.0", "2.0.1", "3.0"]) {
+      expect(
+        validateRuntimeConfig({
+          ...validV1Config,
+          CONFIG_SCHEMA_VERSION: version,
+        }).success,
+      ).toBe(false);
+    }
+  });
+
+  it.each([
+    "file:///tmp/api/",
+    "data:text/plain,/",
+    "blob:https://example.test/00000000-0000-0000-0000-000000000000",
+  ])("rejects a non-HTTP API endpoint in local mode: %s", (API_BASE_URL) => {
+    expect(validateRuntimeConfig({ ...validConfig, API_BASE_URL }).success).toBe(
+      false,
+    );
+  });
+
+  it.each(["file:///tmp/telemetry", "data:text/plain,telemetry"])(
+    "rejects a non-HTTP telemetry endpoint in local mode: %s",
+    (TELEMETRY_ENDPOINT) => {
+      expect(
+        validateRuntimeConfig({
+          ...validConfig,
+          TELEMETRY_ENABLED: true,
+          TELEMETRY_ENDPOINT,
+        }).success,
+      ).toBe(false);
+    },
+  );
+
   it("validates a fetched config under the 500ms budget excluding network", async () => {
     let current = 100;
     const result = await loadRuntimeConfig({
@@ -59,12 +131,38 @@ describe("runtime configuration boundary", () => {
         routerBasePath: "/",
         runtimeConfigUrl: "/config.json",
       },
-      fetcher: async () => new Response(JSON.stringify(validConfig)),
+      fetcher: async () =>
+        new Response(JSON.stringify(validConfig), {
+          headers: { "content-type": "application/json" },
+        }),
       now: () => (current += 2),
     });
 
     expect(result.validationDurationMs).toBeLessThanOrEqual(500);
-    expect(result.config.API_BASE_URL).toBe("http://localhost:8080");
+    expect(result.config.API_BASE_URL).toBe("http://localhost:8080/");
+    expect(result.configSchema).toBe("V2");
+    expect(result.config.CAPABILITY_OVERRIDES.SERVICE_WORKER).toBe("DEFAULT");
+  });
+
+  it("does not include network acquisition in validationDurationMs", async () => {
+    let current = 0;
+    const result = await loadRuntimeConfig({
+      buildConfig: {
+        buildId: "build-a",
+        commitSha: "local",
+        routerBasePath: "/",
+        runtimeConfigUrl: "/config.json",
+      },
+      fetcher: async () => {
+        current = 10_000;
+        return new Response(JSON.stringify(validConfig), {
+          headers: { "content-type": "application/json" },
+        });
+      },
+      now: () => current,
+    });
+
+    expect(result.validationDurationMs).toBe(0);
   });
 
   it("returns only safe boot fields on failure", async () => {
@@ -76,7 +174,10 @@ describe("runtime configuration boundary", () => {
           routerBasePath: "/",
           runtimeConfigUrl: "/config.json",
         },
-        fetcher: async () => new Response("{"),
+        fetcher: async () =>
+          new Response("{", {
+            headers: { "content-type": "application/json" },
+          }),
       }),
     ).rejects.toMatchObject({
       safe: {