test : just complete

lib/security/http.test.ts

@@ -1,12 +1,20 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 import { boundedBody, errorResponse, HttpError, readJson, requireSameOrigin, withUploadSlot } from "./http";
 import { trustedClientAddress } from "./rate-limit";
 
-afterEach(() => vi.unstubAllEnvs());
+const originalAuthUrl = process.env.BETTER_AUTH_URL;
+const originalClientIpHeader = process.env.TRUSTED_CLIENT_IP_HEADER;
+
+afterEach(() => {
+  if (originalAuthUrl === undefined) delete process.env.BETTER_AUTH_URL;
+  else process.env.BETTER_AUTH_URL = originalAuthUrl;
+  if (originalClientIpHeader === undefined) delete process.env.TRUSTED_CLIENT_IP_HEADER;
+  else process.env.TRUSTED_CLIENT_IP_HEADER = originalClientIpHeader;
+});
 
 describe("request boundaries", () => {
   it("compares origin to configuration, not attacker-controlled Host", () => {
-    vi.stubEnv("BETTER_AUTH_URL", "https://guide.example.test");
+    process.env.BETTER_AUTH_URL = "https://guide.example.test";
     expect(() => requireSameOrigin(new Request("https://evil.test", { headers: { origin: "https://evil.test", host: "evil.test" } }))).toThrow("cross-origin");
     expect(() => requireSameOrigin(new Request("http://internal", { headers: { origin: "https://guide.example.test" } }))).not.toThrow();
     expect(() => requireSameOrigin(new Request("http://internal"))).toThrow("cross-origin");
@@ -54,9 +62,9 @@ describe("request boundaries", () => {
   });
 
   it("ignores spoofed forwarding headers unless explicitly configured", () => {
-    vi.stubEnv("TRUSTED_CLIENT_IP_HEADER", "");
+    process.env.TRUSTED_CLIENT_IP_HEADER = "";
     expect(trustedClientAddress(new Headers({ "x-forwarded-for": "1.2.3.4" }))).toBe("unknown");
-    vi.stubEnv("TRUSTED_CLIENT_IP_HEADER", "x-real-ip");
+    process.env.TRUSTED_CLIENT_IP_HEADER = "x-real-ip";
     expect(trustedClientAddress(new Headers({ "x-real-ip": "1.2.3.4, 5.6.7.8" }))).toBe("unknown");
     expect(trustedClientAddress(new Headers({ "x-real-ip": "::ffff:192.0.2.1" }))).toBe("192.0.2.1");
     expect(trustedClientAddress(new Headers({ "x-real-ip": "2001:db8:1:2::1234" })))