security: harden production configuration and routes

apps/pip-platform/tests/unit/test_settings_security.py

@@ -0,0 +1,41 @@
+import pytest
+
+from src.infrastructure.config.settings import Settings
+
+
+def test_production_rejects_placeholder_jwt_secret():
+    with pytest.raises(ValueError, match="JWT_SECRET_KEY"):
+        Settings(
+            NODE_ENV="production",
+            JWT_SECRET_KEY="change-me-in-production",
+            _env_file=None,
+        )
+
+
+def test_production_rejects_default_database_and_broker_credentials():
+    with pytest.raises(ValueError, match="credentials"):
+        Settings(
+            NODE_ENV="production",
+            JWT_SECRET_KEY="a-real-test-secret",
+            DATABASE_URL="postgresql+asyncpg://pip:pip@localhost:5432/pip",
+            RABBITMQ_URL="amqp://pip:pip@localhost:5672/pip",
+            _env_file=None,
+        )
+
+
+def test_production_rejects_wildcard_credentialed_cors():
+    with pytest.raises(ValueError, match="CORS"):
+        Settings(
+            NODE_ENV="production",
+            JWT_SECRET_KEY="a-real-test-secret",
+            DATABASE_URL="postgresql+asyncpg://pip:real-password@db:5432/pip",
+            RABBITMQ_URL="amqp://pip:real-password@rabbitmq:5672/pip",
+            CORS_ORIGINS=["*"],
+            CORS_ALLOW_CREDENTIALS=True,
+            _env_file=None,
+        )
+
+
+def test_development_keeps_local_defaults_usable():
+    settings = Settings(_env_file=None)
+    assert settings.NODE_ENV == "development"