tech-log-frontend/tests/unit/deployment-admission.test.ts

import { readFile, readdir } from "node:fs/promises";
import path from "node:path";

import { describe, expect, it } from "vitest";

import {
  DEPLOYMENT_TARGETS,
  findAdmissionViolations,
  isDeploymentTarget,
  type AdmissionInput,
} from "../../src/contracts/deployment-admission.ts";
import { runtimeConfigV2ArtifactSchema } from "../../src/contracts/release-artifacts.ts";
import { generateRuntimeConfig } from "../../scripts/generate-runtime-config.ts";

const PRODUCTION_ARTIFACT: AdmissionInput = Object.freeze({
  APP_ENV: "production",
  API_BASE_URL: "https://api.example.com/",
  REQUEST_TIMEOUT_MS: 10_000,
  MAX_RETRY_ATTEMPTS: 2,
  TELEMETRY_ENABLED: false,
  AUTH_MODE: "external",
  CONFIG_SCHEMA_VERSION: "2.0",
  RELEASE_MANIFEST_URL: "/release-manifest.json",
  BUILD_ID: "20260815.42",
  RELEASE_ID: "r-2026.08.15-1",
  CAPABILITY_OVERRIDES: Object.freeze({
    REALTIME: "DEFAULT",
    WEB_WORKER: "DEFAULT",
    SERVICE_WORKER: "DEFAULT",
    OFFLINE_COMMANDS: "DEFAULT",
  }),
}) as AdmissionInput;

const LOCAL_ARTIFACT: AdmissionInput = Object.freeze({
  ...PRODUCTION_ARTIFACT,
  APP_ENV: "local",
  API_BASE_URL: "http://localhost:8080/",
  AUTH_MODE: "demo",
  BUILD_ID: "local-build",
  RELEASE_ID: "local-release",
}) as AdmissionInput;

describe("deployment admission", () => {
  it("admits an artifact only to the environment it declares", () => {
    expect(findAdmissionViolations("production", PRODUCTION_ARTIFACT)).toEqual([]);
    expect(findAdmissionViolations("local", LOCAL_ARTIFACT)).toEqual([]);
  });

  it("refuses the exact local build that release coherence used to approve", () => {
    // The review's strongest reproduction: FE-GATE-015 passed on a build whose
    // runtime document was APP_ENV=local / AUTH_MODE=demo / loopback API. Each
    // of those is now an independent refusal, so fixing one does not admit it.
    const violations = findAdmissionViolations("production", LOCAL_ARTIFACT);
    const fields = violations.map((violation) => violation.field);
    expect(fields).toContain("APP_ENV");
    expect(fields).toContain("AUTH_MODE");
    expect(fields).toContain("API_BASE_URL");
    expect(fields).toContain("BUILD_ID");
    expect(fields).toContain("RELEASE_ID");
  });

  it("refuses endpoints a browser on the public internet cannot reach", () => {
    for (const host of [
      "http://api.example.com/",
      "https://localhost/",
      "https://127.0.0.1/",
      "https://10.0.0.5/",
      "https://192.168.1.10/",
      "https://172.16.4.4/",
      "https://169.254.169.254/",
      "https://[::1]/",
    ]) {
      const violations = findAdmissionViolations("production", {
        ...PRODUCTION_ARTIFACT,
        API_BASE_URL: host,
      } as AdmissionInput);
      expect(violations.map((violation) => violation.field), host).toContain(
        "API_BASE_URL",
      );
    }
  });

  it("permits a routable public host", () => {
    expect(
      findAdmissionViolations("production", {
        ...PRODUCTION_ARTIFACT,
        API_BASE_URL: "https://api.172.16.example.com/",
      } as AdmissionInput),
    ).toEqual([]);
  });

  it("refuses a placeholder identity on a public target", () => {
    for (const buildId of ["local-build", "local", "dev", "unknown", ""]) {
      const violations = findAdmissionViolations("production", {
        ...PRODUCTION_ARTIFACT,
        BUILD_ID: buildId,
      } as AdmissionInput);
      expect(violations.map((violation) => violation.field), buildId).toContain(
        "BUILD_ID",
      );
    }
  });

  it("treats an unknown target as not a target at all", () => {
    for (const value of ["prod", "PRODUCTION", "", undefined, null, 1]) {
      expect(isDeploymentTarget(value), String(value)).toBe(false);
    }
    for (const target of DEPLOYMENT_TARGETS) {
      expect(isDeploymentTarget(target)).toBe(true);
    }
  });
});

describe("runtime config profiles", () => {
  it("ships one valid profile per deployment target", async () => {
    const files = (await readdir("config/runtime")).sort();
    expect(files).toEqual(
      [...DEPLOYMENT_TARGETS].map((target) => `${target}.json`).sort(),
    );
    for (const target of DEPLOYMENT_TARGETS) {
      const source: unknown = JSON.parse(
        await readFile(path.join("config/runtime", `${target}.json`), "utf8"),
      );
      const parsed = runtimeConfigV2ArtifactSchema.safeParse({
        ...(source as Record<string, unknown>),
        BUILD_ID: "20260815.42",
        RELEASE_ID: "r-1",
      });
      expect(parsed.success, `${target}: ${JSON.stringify(parsed.error?.issues)}`).toBe(
        true,
      );
      expect((source as Record<string, unknown>)["APP_ENV"]).toBe(target);
    }
  });

  it("produces an admissible document for every public target", async () => {
    for (const target of ["staging", "production"] as const) {
      const config = await generateRuntimeConfig(target, {
        VITE_BUILD_ID: "20260815.42",
        RELEASE_ID: "r-2026.08.15-1",
      });
      expect(
        findAdmissionViolations(target, config as unknown as AdmissionInput),
      ).toEqual([]);
    }
  });

  it("refuses a deployment override that would make the document unservable", async () => {
    await expect(
      generateRuntimeConfig("production", {
        VITE_BUILD_ID: "20260815.42",
        RELEASE_ID: "r-1",
        RUNTIME_API_BASE_URL: "http://api.example.com/",
      }),
    ).rejects.toThrow(/runtime config is invalid/u);
  });

  it("keeps a developer build from carrying a released identity by default", async () => {
    const config = await generateRuntimeConfig("local", {});
    expect(config["BUILD_ID"]).toBe("local-build");
    expect(
      findAdmissionViolations("production", config as unknown as AdmissionInput)
        .length,
    ).toBeGreaterThan(0);
  });
});