797d73145e
Mission Control previously set Access-Control-Allow-Origin: * on every route. That widens cross-origin browser access when Cockpit binds beyond loopback, even with bearer auth. Add server-config helpers compatible with PR #28 bind/token patterns: - loopback binds default to local web/API origins for the Heute shell - privileged /api/* routes never receive *; only reflected allowlist hits - non-loopback binds require explicit EVOO_COCKPIT_CORS_ORIGIN - default bind moves to 127.0.0.1 with token gate off-loopback Document env vars in .env.example and cover config/CORS in unit tests. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
24 lines
698 B
TypeScript
24 lines
698 B
TypeScript
import { defineConfig } from "vitest/config";
|
|
|
|
export default defineConfig({
|
|
test: {
|
|
environment: "node",
|
|
setupFiles: ["./packages/testkit/src/pin-test-env.ts"],
|
|
include: [
|
|
".agents/skills/pr-watch/*.test.ts",
|
|
"packages/*/src/**/*.test.{ts,tsx}",
|
|
"infra/sandboxes/supervisor/src/**/*.test.ts",
|
|
"infra/updater/src/**/*.test.ts",
|
|
"apps/desktop/src/**/*.test.ts",
|
|
"apps/web/src/**/*.test.{ts,tsx}",
|
|
"apps/mobile/lib/**/*.test.ts",
|
|
"apps/mobile/plugins/**/*.test.js",
|
|
"apps/api/src/**/*.test.ts",
|
|
"apps/www/src/**/*.test.ts",
|
|
"evoo-platform/**/*.test.js",
|
|
],
|
|
testTimeout: 30_000,
|
|
hookTimeout: 60_000,
|
|
},
|
|
});
|