Refactor Study Desk application structure

src/lib/sessionConfig.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+import { sealData, unsealData } from "iron-session";
+import {
+  DEVELOPMENT_SESSION_SECRET,
+  getSessionOptions,
+} from "./sessionConfig";
+
+describe("session configuration", () => {
+  it.each([undefined, "", "short", DEVELOPMENT_SESSION_SECRET])(
+    "rejects invalid production secret %s",
+    (secret) => {
+      expect(() =>
+        getSessionOptions({ NODE_ENV: "production", SESSION_SECRET: secret })
+      ).toThrow(/SESSION_SECRET/);
+    }
+  );
+
+  it("allows the labelled fallback only outside production", () => {
+    expect(getSessionOptions({ NODE_ENV: "development" }).password).toBe(
+      DEVELOPMENT_SESSION_SECRET
+    );
+  });
+
+  it("honors secure cookies only when explicitly enabled in production", () => {
+    const options = getSessionOptions({
+      NODE_ENV: "production",
+      SESSION_SECRET: "a-secure-production-secret-that-is-long-enough",
+      SECURE_COOKIES: "true",
+    });
+    expect(options.cookieOptions?.secure).toBe(true);
+  });
+
+  it("does not authenticate data sealed with the development fallback under a real secret", async () => {
+    const sealed = await sealData(
+      { isAuthenticated: true },
+      { password: DEVELOPMENT_SESSION_SECRET, ttl: 60 }
+    );
+    await expect(unsealData(sealed, {
+      password: "a-secure-production-secret-that-is-long-enough",
+      ttl: 60,
+    })).resolves.toEqual({});
+  });
+});