security: harden production configuration and routes

apps/backend/__tests__/required-env.test.js

@@ -0,0 +1,30 @@
+import { describe, expect, test } from '@jest/globals'
+import { validateProductionEnv } from '../src/config/required-env.js'
+
+describe('validateProductionEnv', () => {
+  test('rejects a missing production session secret', () => {
+    expect(() => validateProductionEnv({
+      NODE_ENV: 'production',
+      CORS_ORIGIN: 'https://app.example.com',
+      PG_URL: 'postgres://app:password@db/app',
+    })).toThrow(/SESSION_SECRET/i)
+  })
+
+  test('rejects placeholder production configuration', () => {
+    expect(() => validateProductionEnv({
+      NODE_ENV: 'production',
+      SESSION_SECRET: 'farma-clic-secret-key-change-in-production',
+      CORS_ORIGIN: 'http://localhost:3000',
+      PG_URL: 'postgres://app:password@db/app',
+    })).toThrow(/placeholder|production/i)
+  })
+
+  test('accepts complete non-placeholder production configuration', () => {
+    expect(() => validateProductionEnv({
+      NODE_ENV: 'production',
+      SESSION_SECRET: 'a-test-only-long-session-secret',
+      CORS_ORIGIN: 'https://app.example.com',
+      PG_URL: 'postgres://app:password@db/app',
+    })).not.toThrow()
+  })
+})