@teleporthq/teleport-plugin-next-workflows 0.43.66 → 0.43.68

package/__tests__/admin-form-row-hydration.test.ts

@@ -0,0 +1,113 @@
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+// The admin form hydration helpers are emitted verbatim into the generated
+// page from a template literal in the plugin. Pull them out of the source and
+// run them, so what is asserted is what the page runs.
+const pluginSource = readFileSync(join(__dirname, '../src/workflow-component-plugin.ts'), 'utf8')
+
+const extractHelper = (name: string): string => {
+  const match = pluginSource.match(new RegExp(`function ${name}\\([^)]*\\) \\{[\\s\\S]*?\\n\\}\\n`))
+  if (!match) {
+    throw new Error(`helper ${name} not found in the plugin source`)
+  }
+  // Backticks are escaped inside the template literal.
+  return match[0].replace(/\\`/g, '`')
+}
+
+const helpers = new Function(
+  `${extractHelper('__normalizeTagsForFormInput')}\n${extractHelper('__normalizeAdminFormRow')}\n` +
+    'return { normalizeRow: __normalizeAdminFormRow, normalizeTags: __normalizeTagsForFormInput }'
+)() as {
+  normalizeRow: (row: unknown, defaults: Record<string, unknown>) => Record<string, unknown>
+  normalizeTags: (value: unknown) => string
+}
+
+const DEFAULTS = { name: '', tags: '', es_name: '', es_tags: '', zh_tags: '' }
+
+describe('__normalizeAdminFormRow', () => {
+  it('keeps the per-language columns the form binds', () => {
+    const row = { id: 3, name: 'Lamp', es_name: 'Lámpara', color: 'red' }
+    expect(helpers.normalizeRow(row, DEFAULTS)).toEqual({
+      name: 'Lamp',
+      tags: '',
+      es_name: 'Lámpara',
+      es_tags: '',
+      zh_tags: '',
+    })
+  })
+
+  it('reshapes a language copy of the tags like the tags themselves', () => {
+    const row = { tags: ['light', 'desk'], es_tags: '{"luz","escritorio"}', zh_tags: ['灯'] }
+    expect(helpers.normalizeRow(row, DEFAULTS)).toMatchObject({
+      tags: 'light, desk',
+      es_tags: 'luz, escritorio',
+      zh_tags: '灯',
+    })
+  })
+
+  it('falls back to the default for a language the row has nothing for', () => {
+    expect(helpers.normalizeRow({ name: 'Lamp', es_name: null }, DEFAULTS)).toMatchObject({
+      es_name: '',
+      es_tags: '',
+    })
+  })
+})
+
+describe('__normalizeAdminFormRow — a product loaded as stored', () => {
+  const PRODUCT_DEFAULTS = {
+    name: '',
+    gallery_images: '',
+    is_digital: false,
+    is_gift_card: false,
+    discounts: '',
+  }
+
+  it('shows a JSON gallery one URL per line, and keeps anything else as typed', () => {
+    const row = { gallery_images: '["https://a.io/1.png","https://a.io/2.png"]' }
+    expect(helpers.normalizeRow(row, PRODUCT_DEFAULTS).gallery_images).toBe(
+      'https://a.io/1.png\nhttps://a.io/2.png'
+    )
+    expect(
+      helpers.normalizeRow({ gallery_images: 'https://a.io/1.png' }, PRODUCT_DEFAULTS)
+        .gallery_images
+    ).toBe('https://a.io/1.png')
+    expect(
+      helpers.normalizeRow({ gallery_images: '[not json' }, PRODUCT_DEFAULTS).gallery_images
+    ).toBe('[not json')
+  })
+
+  it('reads a flag that arrives as text as the boolean it is — "false" is not a ticked box', () => {
+    const fromView = helpers.normalizeRow(
+      { isDigital: 'true', isGiftCard: 'false' },
+      PRODUCT_DEFAULTS
+    )
+    expect(fromView.is_digital).toBe(true)
+    expect(fromView.is_gift_card).toBe(false)
+    const fromPostgres = helpers.normalizeRow(
+      { is_digital: 't', is_gift_card: 'f' },
+      PRODUCT_DEFAULTS
+    )
+    expect(fromPostgres).toMatchObject({ is_digital: true, is_gift_card: false })
+    const stored = helpers.normalizeRow({ is_digital: true, is_gift_card: false }, PRODUCT_DEFAULTS)
+    expect(stored).toMatchObject({ is_digital: true, is_gift_card: false })
+  })
+
+  it('keeps the stored discounts, and a text field that merely says "true"', () => {
+    const discounts = '[{"id":"d1","type":"fixed","value":10}]'
+    const out = helpers.normalizeRow({ discounts, name: 'true' }, PRODUCT_DEFAULTS)
+    expect(out.discounts).toBe(discounts)
+    expect(out.name).toBe('true')
+  })
+})
+
+describe('__normalizeTagsForFormInput', () => {
+  it('shows the editor’s JSON list, a Postgres array and an array alike, and keeps plain text', () => {
+    expect(helpers.normalizeTags('["light","desk"]')).toBe('light, desk')
+    expect(helpers.normalizeTags('{"light","desk"}')).toBe('light, desk')
+    expect(helpers.normalizeTags(['light', 'desk'])).toBe('light, desk')
+    expect(helpers.normalizeTags('light, desk')).toBe('light, desk')
+    expect(helpers.normalizeTags('[not json]')).toBe('[not json]')
+    expect(helpers.normalizeTags(null)).toBe('')
+  })
+})

package/__tests__/ai-select-database-data-handler.test.ts

@@ -13,7 +13,11 @@ import { generateSharedRuntimeUtilsCode } from '../src/executor-generator'
 interface MockState {
   aiResponses: string[]
   aiCalls: Array<{ systemMessage: string; userMessage: string; jsonMode: boolean }>
-  fetchCalls: Array<{ url: string; body: { query: string; params: unknown[] } }>
+  fetchCalls: Array<{
+    url: string
+    body: { query: string; params: unknown[] }
+    headers: Record<string, string>
+  }>
   fetchResponse: { ok: boolean; json: unknown }
 }
 
@@ -27,8 +31,11 @@ function loadHandler(state: MockState) {
     };
   `
   const source = aiSelectDatabaseData.generateServerHandler!()
-  const fetchMock = async (url: string, init: { body: string }) => {
-    state.fetchCalls.push({ url, body: JSON.parse(init.body) })
+  const fetchMock = async (
+    url: string,
+    init: { body: string; headers: Record<string, string> }
+  ) => {
+    state.fetchCalls.push({ url, body: JSON.parse(init.body), headers: init.headers })
     return {
       ok: state.fetchResponse.ok,
       json: async () => state.fetchResponse.json,
@@ -92,6 +99,10 @@ describe('happy path', () => {
     expect(state.aiCalls[0].systemMessage).toContain('TABLE "teleport_products"')
     expect(state.fetchCalls).toHaveLength(1)
     expect(state.fetchCalls[0].url).toBe('/api/data/ds1/raw-query')
+    // A server-side call, marked as SQL it did not write: the data route lets
+    // it run raw SQL but keeps it off the money tables and the users' roles.
+    expect(state.fetchCalls[0].headers['x-tq-restricted-sql']).toBe('1')
+    expect(state.fetchCalls[0].headers).toHaveProperty('x-internal-data-secret')
     // The executed SQL carries the enforced LIMIT
     expect(state.fetchCalls[0].body.query).toBe('SELECT "id" FROM "teleport_products" LIMIT 100')
   })

package/__tests__/api-route-file-name-segments.test.ts

@@ -0,0 +1,33 @@
+import { getAPIRouteFileName } from '../src/api-route-generator'
+
+/**
+ * A workflow's server segments each get their own API route file, and the
+ * client's URL map is built from the same names. Capping the segment id at
+ * eight characters spelled `server-10`, `server-11` and `server-12` as
+ * `server-1`: the tenth segment's file overwrote the first, and the client
+ * sent the first call of the workflow to whatever the last segment held. On
+ * the checkout that was the payment charge, reached before the cart was
+ * validated or the order written.
+ */
+describe('getAPIRouteFileName', () => {
+  it('gives every server segment its own file, past the ninth', () => {
+    const names = Array.from({ length: 14 }, (_, index) =>
+      getAPIRouteFileName(
+        '19df4d9e-6409-40a4-bbb9-3645b2afcf3b',
+        `server-${index + 1}`,
+        'Place Order 2'
+      )
+    )
+    expect(new Set(names).size).toBe(names.length)
+    expect(names[0]).toBe('place-order-2-19df4d9e-seg-server-1')
+    expect(names[9]).toBe('place-order-2-19df4d9e-seg-server-10')
+    expect(names[11]).toBe('place-order-2-19df4d9e-seg-server-12')
+  })
+
+  it('keeps the workflow-id suffix that tells two same-named workflows apart', () => {
+    const a = getAPIRouteFileName('aaaaaaaa-1111', 'server-1', 'Place Order')
+    const b = getAPIRouteFileName('bbbbbbbb-2222', 'server-1', 'Place Order')
+    expect(a).not.toBe(b)
+    expect(a).toBe('place-order-aaaaaaaa-seg-server-1')
+  })
+})

package/__tests__/app-secret-env.test.ts

@@ -0,0 +1,55 @@
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+
+// Server code tells itself apart from a browser with the app secret: it keys
+// the signatures on results relayed between workflow steps and the
+// internal-call token, and server code presents it to its own data, invoice
+// and notification routes. An app with such routes but no authentication
+// used to ship without one — every one of those keyed from ''.
+
+const structure = (uidl: unknown): any => ({
+  uidl,
+  strategy: { pages: { options: {} } },
+  files: new Map(),
+  dependencies: {},
+  devDependencies: {},
+})
+
+const app = (extra: Record<string, unknown> = {}): any => ({
+  name: 'Site',
+  globals: { settings: { title: 'Site' } },
+  root: { name: 'Root', stateDefinitions: {}, node: { type: 'element', content: {} } },
+  ...extra,
+})
+
+const secretOf = async (uidl: any): Promise<unknown> => {
+  await new NextWorkflowProjectPlugin().runBefore(structure(uidl))
+  return uidl.globals.env?.NEXTAUTH_SECRET
+}
+
+describe('the app secret of a generated app', () => {
+  it('is written for an app with server routes and no authentication', async () => {
+    for (const extra of [
+      { workflows: { workflows: { w1: { nodes: [], edges: [] } }, customNodes: {} } },
+      { dataSources: { ds1: { type: 'postgresql' } } },
+      { invoiceSettings: { enabled: true } },
+      { ecommerceSettings: { currency: 'USD' } },
+    ]) {
+      expect(await secretOf(app(extra))).toMatch(/^[0-9a-f]{64}$/)
+    }
+  })
+
+  it('is a fresh value each time, never a constant', async () => {
+    const extra = { dataSources: { ds1: { type: 'postgresql' } } }
+    expect(await secretOf(app(extra))).not.toBe(await secretOf(app(extra)))
+  })
+
+  it('keeps a secret the project already has', async () => {
+    const uidl = app({ dataSources: { ds1: { type: 'postgresql' } } })
+    uidl.globals.env = { NEXTAUTH_SECRET: 'configured-secret' }
+    expect(await secretOf(uidl)).toBe('configured-secret')
+  })
+
+  it('is not written for a static site', async () => {
+    expect(await secretOf(app())).toBeUndefined()
+  })
+})

package/__tests__/auth-env-secret-preservation.test.ts

@@ -1,5 +1,8 @@
 import { resolveAuthEnvValue, collectOAuthCredentialEnvKeys } from '../src/workflow-project-plugin'
 
+/** What a generated NEXTAUTH_SECRET default looks like: 32 random bytes, hex. */
+const RANDOM_SECRET = /^[0-9a-f]{64}$/
+
 // Regression: OAuth provider credentials never reached the deployed env →
 // NextAuth `error=OAuthSignin` ("Continue with Google" does nothing). The auth
 // plugin's `resolveAuthEnvValue` EMPTIED every `teleporthq.secrets.X` env value
@@ -105,7 +108,7 @@ describe('resolveAuthEnvValue', () => {
   it('keeps NEXTAUTH defaults and leaves non-auth behavior unchanged', () => {
     expect(
       resolveAuthEnvValue('NEXTAUTH_SECRET', 'teleporthq.secrets.NEXTAUTH_SECRET', oauthKeys)
-    ).toBe('CHANGE_ME_TO_A_RANDOM_SECRET')
+    ).toMatch(RANDOM_SECRET)
     expect(resolveAuthEnvValue('NEXTAUTH_URL', 'teleporthq.secrets.NEXTAUTH_URL', oauthKeys)).toBe(
       'http://localhost:3000'
     )
@@ -133,8 +136,24 @@ describe('resolveAuthEnvValue', () => {
       }
     )
 
-    it('a blank NEXTAUTH_SECRET heals to the placeholder default', () => {
-      expect(resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)).toBe(
+    // NEXTAUTH_SECRET signs every session and is the secret server code shows
+    // its own routes: a default anyone can read in the generator is no secret.
+    // Each generation draws its own; the deploy worker still replaces the line.
+    it('a blank NEXTAUTH_SECRET heals to a fresh random secret, never a known constant', () => {
+      const first = resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)
+      const second = resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)
+      expect(first).toMatch(RANDOM_SECRET)
+      expect(second).toMatch(RANDOM_SECRET)
+      expect(first).not.toBe(second)
+      expect(first).not.toBe('CHANGE_ME_TO_A_RANDOM_SECRET')
+    })
+
+    it('the constant earlier generations shipped is replaced, not carried over from a .env', () => {
+      expect(
+        resolveAuthEnvValue('NEXTAUTH_SECRET', 'CHANGE_ME_TO_A_RANDOM_SECRET', oauthKeys)
+      ).toMatch(RANDOM_SECRET)
+      // Only for the secret: another key holding that text is left alone.
+      expect(resolveAuthEnvValue('SOME_OTHER_KEY', 'CHANGE_ME_TO_A_RANDOM_SECRET', oauthKeys)).toBe(
         'CHANGE_ME_TO_A_RANDOM_SECRET'
       )
     })

package/__tests__/auth-nextauth-url.test.ts

@@ -1,87 +1,171 @@
 /* tslint:disable:no-eval */
 import { generateNextAuthRouteFile } from '../src/auth-generator'
 
-// The generated .env ships a localhost NEXTAUTH_URL (the deploy domain is
-// unknown at build time). NextAuth builds OAuth callback/redirect URLs from
-// NEXTAUTH_URL, so on a published domain that localhost value would break the
-// OAuth round-trip. The generated /api/auth/[...nextauth] route now derives the
-// real origin from the incoming request — without hardcoding it — while
-// respecting an explicitly-set NEXTAUTH_URL and leaving local dev alone.
-
-// Load the emitted route with `next-auth` + auth-options stubbed so we can
-// exercise the per-request NEXTAUTH_URL derivation against a fake request.
-function loadRoute(): (req: any, res: any) => any {
-  const code = generateNextAuthRouteFile()
-  const fakeNextAuth = () => (_req: any, _res: any) => ({ usedUrl: process.env.NEXTAUTH_URL })
+// The generated .env ships a localhost (or empty) NEXTAUTH_URL — the deploy
+// domain is unknown at build time. NextAuth builds OAuth callback/redirect URLs
+// AND picks its cookie names ("__Secure-" on https) from NEXTAUTH_URL, so the
+// generated /api/auth/[...nextauth] route derives the origin from the incoming
+// request — without hardcoding it — while respecting an explicitly-set real
+// NEXTAUTH_URL.
+//
+// The configured value is read ONCE per process, before any request; every request
+// then gets its own origin. It used to be written back and kept, so one request
+// through an https tunnel (ngrok forwarding webhooks to a local dev server)
+// turned every later localhost request into an https one: NextAuth issued
+// "__Secure-" cookies on localhost beside the plain ones, and the middleware,
+// reading the stale plain cookie, refused a signed-in admin.
+
+type Handler = (req: unknown, res: unknown) => unknown
+
+const CONFIGURED_STORE_KEY = '__tqConfiguredNextAuthUrl'
+
+// Loads the emitted route with `next-auth` + auth-options stubbed, under the
+// NEXTAUTH_URL the deployment configured — as a fresh process would, unless
+// `hotReload` re-evaluates it inside the same process. Returns the handler and
+// a reader for the origin NextAuth saw on the last call.
+function loadRoute(
+  configured: string | undefined,
+  options: { hotReload?: boolean } = {}
+): {
+  handler: Handler
+  originSeen: () => string | undefined
+} {
+  if (!options.hotReload) {
+    delete (globalThis as Record<string, unknown>)[CONFIGURED_STORE_KEY]
+    if (configured === undefined) {
+      delete process.env.NEXTAUTH_URL
+    } else {
+      process.env.NEXTAUTH_URL = configured
+    }
+  }
+  let seen: string | undefined
+  const fakeNextAuth = () => () => {
+    // NextAuth reads the env var synchronously when the handler is entered.
+    seen = process.env.NEXTAUTH_URL
+  }
   const fakeRequire = (id: string) => (id === 'next-auth' ? fakeNextAuth : {})
-  const moduleObj: { exports: any } = { exports: {} }
+  const moduleObj: { exports: Handler } = { exports: (() => undefined) as Handler }
   // eslint-disable-next-line @typescript-eslint/no-implied-eval
-  const fn = new Function('require', 'module', 'process', code)
-  fn(fakeRequire, moduleObj, process)
-  return moduleObj.exports
+  const fn = new Function('require', 'module', 'process', 'console', generateNextAuthRouteFile())
+  fn(fakeRequire, moduleObj, process, { error: () => undefined })
+  return { handler: moduleObj.exports, originSeen: () => seen }
 }
 
-describe('generated NextAuth route — dynamic NEXTAUTH_URL', () => {
-  const handler = loadRoute()
+const request = (headers: Record<string, string | string[]>) => ({ headers })
+
+describe('generated NextAuth route — per-request NEXTAUTH_URL', () => {
   let saved: string | undefined
 
   beforeEach(() => {
     saved = process.env.NEXTAUTH_URL
   })
   afterEach(() => {
-    if (saved === undefined) delete process.env.NEXTAUTH_URL
-    else process.env.NEXTAUTH_URL = saved
+    delete (globalThis as Record<string, unknown>)[CONFIGURED_STORE_KEY]
+    if (saved === undefined) {
+      delete process.env.NEXTAUTH_URL
+    } else {
+      process.env.NEXTAUTH_URL = saved
+    }
   })
 
   it('derives the origin from the request host when NEXTAUTH_URL is the localhost default', () => {
-    process.env.NEXTAUTH_URL = 'http://localhost:3000'
-    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://my-app.teleporthq.dev')
+    const { handler, originSeen } = loadRoute('http://localhost:3000')
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://my-app.teleporthq.dev')
   })
 
-  it('uses x-forwarded-host and defaults the protocol to https', () => {
-    process.env.NEXTAUTH_URL = ''
-    handler({ headers: { 'x-forwarded-host': 'sugary.teleporthq.dev', host: 'internal:3000' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://sugary.teleporthq.dev')
+  it('uses x-forwarded-host and defaults the protocol to https for a real domain', () => {
+    const { handler, originSeen } = loadRoute('')
+    handler(request({ 'x-forwarded-host': 'sugary.teleporthq.dev', host: 'internal:3000' }), {})
+    expect(originSeen()).toBe('https://sugary.teleporthq.dev')
   })
 
-  it('respects an explicitly-configured real NEXTAUTH_URL (does not clobber it)', () => {
-    process.env.NEXTAUTH_URL = 'https://custom-domain.com'
-    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://custom-domain.com')
+  it('respects an explicitly-configured real NEXTAUTH_URL on every request', () => {
+    const { handler, originSeen } = loadRoute('https://custom-domain.com')
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://custom-domain.com')
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('https://custom-domain.com')
   })
 
-  it('leaves local development untouched', () => {
-    process.env.NEXTAUTH_URL = 'http://localhost:3000'
-    handler({ headers: { host: 'localhost:3000' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('http://localhost:3000')
+  it('gives local development its own plain-http origin, port included', () => {
+    const { handler, originSeen } = loadRoute('http://localhost:3000')
+    handler(request({ host: 'localhost:3000' }), {})
+    expect(originSeen()).toBe('http://localhost:3000')
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('http://localhost:3001')
+    handler(request({ host: '[::1]:3001' }), {})
+    expect(originSeen()).toBe('http://[::1]:3001')
+  })
+
+  it('THE DEFECT: a request through an https tunnel does not change the origin of the next localhost request', () => {
+    const { handler, originSeen } = loadRoute('')
+    handler(
+      request({
+        host: 'localhost:3001',
+        'x-forwarded-host': 'b16a-example.ngrok-free.app',
+        'x-forwarded-proto': 'https',
+      }),
+      {}
+    )
+    expect(originSeen()).toBe('https://b16a-example.ngrok-free.app')
+
+    // The next browser request on localhost: plain http again, so NextAuth
+    // keeps using (and refreshing) the plain session cookie.
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('http://localhost:3001')
+  })
+
+  it('a dev server reloading the route after a tunnel request still knows what was configured', () => {
+    const first = loadRoute('')
+    first.handler(
+      request({ host: 'b16a-example.ngrok-free.app', 'x-forwarded-proto': 'https' }),
+      {}
+    )
+    // process.env now holds the tunnel origin; the module is evaluated again.
+    const reloaded = loadRoute(undefined, { hotReload: true })
+    reloaded.handler(request({ host: 'localhost:3001' }), {})
+    expect(reloaded.originSeen()).toBe('http://localhost:3001')
+  })
+
+  it('reads the client-facing hop of a proxy chain', () => {
+    const { handler, originSeen } = loadRoute(undefined)
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https,http' }), {})
+    expect(originSeen()).toBe('https://my-app.teleporthq.dev')
+    handler(request({ host: ['shop.example.com'], 'x-forwarded-proto': ['https'] }), {})
+    expect(originSeen()).toBe('https://shop.example.com')
   })
 
   // Project a62338f9 published with `NEXTAUTH_URL=teleporthq.secrets.NEXTAUTH_URL`.
   // The old check saw a non-empty, non-localhost string and treated it as
   // explicitly configured, so NextAuth normalised it to
   // `https://teleporthq.secrets.nextauth_url`, advertised that as the sign-in
-  // origin and issued `__Host-`/`__Secure-` cookies against it. Sign-in failed
-  // with a bare `credentialsSignin`. An unresolved placeholder is now treated
-  // as unset, so an already-published site self-heals on its next request.
+  // origin and issued `__Host-`/`__Secure-` cookies against it. An unresolved
+  // placeholder is treated as unset, so an already-published site self-heals.
   it('overrides an unresolved secret placeholder on a published domain', () => {
-    process.env.NEXTAUTH_URL = 'teleporthq.secrets.NEXTAUTH_URL'
-    handler(
-      { headers: { host: 'rare-last-dunlin.teleporthq.dev', 'x-forwarded-proto': 'https' } },
-      {}
-    )
-    expect(process.env.NEXTAUTH_URL).toBe('https://rare-last-dunlin.teleporthq.dev')
+    const { handler, originSeen } = loadRoute('teleporthq.secrets.NEXTAUTH_URL')
+    handler(request({ host: 'rare-last-dunlin.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://rare-last-dunlin.teleporthq.dev')
   })
 
   it('falls back to an http origin locally, so cookies are not Secure-prefixed', () => {
-    process.env.NEXTAUTH_URL = 'teleporthq.secrets.NEXTAUTH_URL'
-    handler({ headers: { host: 'localhost:3001' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('http://localhost:3001')
+    const { handler, originSeen } = loadRoute('teleporthq.secrets.NEXTAUTH_URL')
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('http://localhost:3001')
   })
 
   it('overrides any value that is not an absolute http(s) origin', () => {
-    process.env.NEXTAUTH_URL = 'my-app.teleporthq.dev'
-    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://my-app.teleporthq.dev')
+    const { handler, originSeen } = loadRoute('my-app.teleporthq.dev')
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://my-app.teleporthq.dev')
+  })
+
+  it('keeps the configured value when the request names no host at all', () => {
+    const { handler, originSeen } = loadRoute('http://localhost:3000')
+    handler(request({}), {})
+    expect(originSeen()).toBe('http://localhost:3000')
+    const bare = loadRoute(undefined)
+    bare.handler(request({}), {})
+    expect(bare.originSeen()).toBe('http://localhost:3000')
   })
 })