21e6f4c2d5
The @pcbjam/backend-example server had a 1 GiB body limit, no per-owner/per-lib quotas, bound to 0.0.0.0, and reflected any origin with credentials when CORS_ORIGIN is *. Bound the write surface (5 MiB body cap, per-owner lib and per-lib item quotas), bind 127.0.0.1 by default (opt in via HOST), and force credentials off for a wildcard CORS origin. Refactor main() into an exported buildApp() and add web/backend/test/security.test.ts (inject-based). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
10 lines
276 B
TypeScript
10 lines
276 B
TypeScript
import { defineConfig } from "vitest/config";
|
|
|
|
// The reference backend is a Fastify app; tests drive it via app.inject() in a
|
|
// plain node env (no network listen).
|
|
export default defineConfig({
|
|
test: {
|
|
environment: "node",
|
|
include: ["test/**/*.test.ts"],
|
|
},
|
|
});
|