fix: allow explicit HTTP origin in test environments

2026-08-27 18:32:21 +08:00
parent 01cffa4758
commit 070a951e7c
3 changed files with 28 additions and 3 deletions
@@ -26,6 +26,27 @@ describe('OpenApiService', () => {
    }
  });

+  it('only permits a plain HTTP public origin when an isolated test environment explicitly opts in', async () => {
+    const previousOrigin = process.env.HTTP_API_PUBLIC_ORIGIN;
+    const previousAllowInsecure = process.env.HTTP_API_ALLOW_INSECURE_ORIGIN;
+    process.env.HTTP_API_PUBLIC_ORIGIN = 'http://100.93.204.60:12026/';
+    delete process.env.HTTP_API_ALLOW_INSECURE_ORIGIN;
+    const prisma = {
+      smsApplication: { findFirst: jest.fn().mockResolvedValue({ id: 'app-1', name: '应用A', httpConfig: null, httpIpAllowlist: [] }) },
+    };
+    try {
+      const service = new OpenApiService(prisma as never, {} as never);
+      await expect(service.getConfig('app-1')).rejects.toThrow('HTTP_API_ALLOW_INSECURE_ORIGIN');
+      process.env.HTTP_API_ALLOW_INSECURE_ORIGIN = 'true';
+      await expect(service.getConfig('app-1')).resolves.toEqual(expect.objectContaining({ publicOrigin: 'http://100.93.204.60:12026' }));
+    } finally {
+      if (previousOrigin === undefined) delete process.env.HTTP_API_PUBLIC_ORIGIN;
+      else process.env.HTTP_API_PUBLIC_ORIGIN = previousOrigin;
+      if (previousAllowInsecure === undefined) delete process.env.HTTP_API_ALLOW_INSECURE_ORIGIN;
+      else process.env.HTTP_API_ALLOW_INSECURE_ORIGIN = previousAllowInsecure;
+    }
+  });
+
  it('replays a completed request for the same idempotency key and body', async () => {
    const prisma = {
      openApiRequest: { findUnique: jest.fn().mockResolvedValue({ bodyHash: 'same', status: 'completed', responseBody: { code: 'ACCEPTED', messageId: 'MSG-1' } }) },