fix: 加固认证撤销与运行配置

apps/api/src/auth/auth.config.spec.ts

@@ -1,9 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import {
   codeHmac,
+  demoSmsCodeEnabled,
   phoneHmac,
   resetAuthEnvironmentForTests,
   validateAuthEnvironment,
+  webOrigin,
 } from "./auth.config.js";
 
 const valid = {
@@ -12,6 +14,7 @@ const valid = {
   VERIFICATION_CODE_HMAC_KEY: "code-hmac-key-that-is-at-least-32-bytes!",
   REFRESH_TOKEN_HMAC_KEY: "refresh-key-that-is-at-least-thirty-two-bytes",
   JWT_SECRET: "jwt-secret-that-is-at-least-thirty-two-bytes",
+  WEB_ORIGIN: "http://localhost:3000",
 };
 
 describe("auth environment", () => {
@@ -54,4 +57,37 @@ describe("auth environment", () => {
     expect(phoneHmac("+8613800138000")).toBe(phoneDigest);
     expect(codeHmac(phoneDigest, "123456")).not.toBe(first);
   });
+
+  it("fails closed when WEB_ORIGIN is missing or is not one absolute HTTP origin", () => {
+    for (const value of [
+      undefined,
+      "localhost:3000",
+      "https://a.test/path",
+      "https://u:p@a.test",
+      "ftp://a.test",
+    ]) {
+      resetAuthEnvironmentForTests();
+      if (value === undefined) delete process.env.WEB_ORIGIN;
+      else process.env.WEB_ORIGIN = value;
+      expect(() => validateAuthEnvironment()).toThrow(/WEB_ORIGIN/);
+    }
+  });
+
+  it("caches and exposes the validated web origin", () => {
+    validateAuthEnvironment();
+    expect(webOrigin()).toBe("http://localhost:3000");
+  });
+
+  it("returns demo codes only in test or explicitly enabled local development", () => {
+    delete process.env.DEMO_SMS_CODE_ENABLED;
+    expect(demoSmsCodeEnabled()).toBe(false);
+    process.env.DEMO_SMS_CODE_ENABLED = "true";
+    expect(demoSmsCodeEnabled()).toBe(true);
+    process.env.NODE_ENV = "staging";
+    expect(demoSmsCodeEnabled()).toBe(false);
+    process.env.NODE_ENV = "development";
+    expect(demoSmsCodeEnabled()).toBe(true);
+    process.env.NODE_ENV = "production";
+    expect(demoSmsCodeEnabled()).toBe(false);
+  });
 });