root
41 lines
1.4 KiB
TypeScript
41 lines
1.4 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
assertSafeTestDatabaseUrl,
|
|
assertSeedDatabaseAllowed,
|
|
} from "../../prisma/database-safety";
|
|
|
|
describe("test database safety guard", () => {
|
|
it.each([
|
|
"postgresql://drift:secret@db.example.com/app_test",
|
|
"postgresql://drift:secret@127.0.0.1/production",
|
|
"not a url",
|
|
])("rejects unsafe DATABASE_URL without exposing it: %s", (url) => {
|
|
expect(() => assertSafeTestDatabaseUrl(url)).toThrowError(
|
|
"Refusing database operation: DATABASE_URL must target localhost or 127.0.0.1 and a database ending in _test.",
|
|
);
|
|
try {
|
|
assertSafeTestDatabaseUrl(url);
|
|
} catch (error) {
|
|
expect(String(error)).not.toContain(url);
|
|
expect(String(error)).not.toContain("secret");
|
|
}
|
|
});
|
|
|
|
it.each([
|
|
"postgresql://drift:secret@localhost:55432/drift_bottle_test?schema=public",
|
|
"postgresql://drift:secret@127.0.0.1:55432/drift_bottle_test",
|
|
])("accepts an isolated local test database: %s", (url) => {
|
|
expect(() => assertSafeTestDatabaseUrl(url)).not.toThrow();
|
|
});
|
|
|
|
it("requires explicit authorization before seeding a non-test database", () => {
|
|
const productionUrl = "postgresql://drift:secret@db.example.com/production";
|
|
expect(() => assertSeedDatabaseAllowed(productionUrl, {})).toThrow();
|
|
expect(() =>
|
|
assertSeedDatabaseAllowed(productionUrl, {
|
|
ALLOW_SEED_NON_TEST_DATABASE: "true",
|
|
}),
|
|
).not.toThrow();
|
|
});
|
|
});
|