feat(api): add secure Fastify skeleton

2026-07-16 11:36:24 +08:00
parent a86970d33b
commit 26c1bcc6da
8 changed files with 606 additions and 10 deletions
@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest';
+import { API_DEFAULT_HOST, API_DEFAULT_PORT } from './app.js';
+import { startApi } from './start.js';
+
+describe('API startup boundary', () => {
+  it('consumes the validated loopback listener without opening a real socket', async () => {
+    const calls: unknown[] = [];
+    await startApi({
+      app: {
+        listen: async (options) => {
+          calls.push(options);
+          return 'http://127.0.0.1:8790';
+        },
+      },
+    });
+    expect(calls).toEqual([{ host: API_DEFAULT_HOST, port: API_DEFAULT_PORT }]);
+  });
+
+  it('rejects the legacy port before invoking listen', async () => {
+    let called = false;
+    await expect(
+      startApi({
+        environment: { API_PORT: '8788' },
+        app: {
+          listen: async () => {
+            called = true;
+            return '';
+          },
+        },
+      }),
+    ).rejects.toThrow(/reserved|legacy/i);
+    expect(called).toBe(false);
+  });
+});