familysync/apps/api/tests/lib/bootGuards.test.ts

/**
 * assertNotDevBypassInProduction() — unit tests.
 *
 * Tests the three behavioral cases:
 *  1. NODE_ENV='production' AND DEV_AUTH_BYPASS='true' → calls process.exit(1)
 *  2. NODE_ENV='development' AND DEV_AUTH_BYPASS='true' → does NOT call process.exit
 *  3. NODE_ENV='production' AND DEV_AUTH_BYPASS unset → does NOT call process.exit
 */

import { describe, it, expect, vi, afterEach } from 'vitest';
import { assertNotDevBypassInProduction } from '../../src/lib/bootGuards.js';

describe('assertNotDevBypassInProduction', () => {
  const originalNodeEnv = process.env.NODE_ENV;
  const originalBypassFlag = process.env.DEV_AUTH_BYPASS;

  afterEach(() => {
    // Restore env after each test
    process.env.NODE_ENV = originalNodeEnv;
    if (originalBypassFlag === undefined) {
      delete process.env.DEV_AUTH_BYPASS;
    } else {
      process.env.DEV_AUTH_BYPASS = originalBypassFlag;
    }
  });

  it('calls process.exit(1) when NODE_ENV=production and DEV_AUTH_BYPASS=true', () => {
    process.env.NODE_ENV = 'production';
    process.env.DEV_AUTH_BYPASS = 'true';

    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
      throw new Error('process.exit called');
    }) as never);

    expect(() => assertNotDevBypassInProduction()).toThrow('process.exit called');
    expect(exitSpy).toHaveBeenCalledWith(1);

    exitSpy.mockRestore();
  });

  it('does NOT call process.exit when NODE_ENV=development and DEV_AUTH_BYPASS=true', () => {
    process.env.NODE_ENV = 'development';
    process.env.DEV_AUTH_BYPASS = 'true';

    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
      throw new Error('process.exit called');
    }) as never);

    expect(() => assertNotDevBypassInProduction()).not.toThrow();
    expect(exitSpy).not.toHaveBeenCalled();

    exitSpy.mockRestore();
  });

  it('does NOT call process.exit when NODE_ENV=production and DEV_AUTH_BYPASS is unset', () => {
    process.env.NODE_ENV = 'production';
    delete process.env.DEV_AUTH_BYPASS;

    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
      throw new Error('process.exit called');
    }) as never);

    expect(() => assertNotDevBypassInProduction()).not.toThrow();
    expect(exitSpy).not.toHaveBeenCalled();

    exitSpy.mockRestore();
  });
});