create-ailk 0.11.1 → 0.11.3

package/templates/apps/api/src/__tests__/trusted-origins.server.test.ts

@@ -0,0 +1,135 @@
+/**
+ * @file trusted-origins.server.test.ts
+ * @description A spoke's cookie-forwarded write through the REAL server (#7395 AC-8).
+ *
+ * The defect #7395 reports: a spoke renders `/account` against the hub API and
+ * forwards the visitor's cookie with the browser's own `Origin`, and every
+ * write came back 401 because the auth preHandler compared that `Origin` with
+ * `===` against the one `FRONTEND_URL`. The unit suites build the plugin
+ * options themselves, so only a boot through `build()` sees what `server.ts`
+ * actually wires — `trustedOrigins: [config.FRONTEND_URL]` would pass every
+ * one of them and still refuse the spoke here.
+ *
+ * Each case rebuilds the module graph (`jest.resetModules()`) because
+ * `config/index.ts` resolves the allowlist at import time.
+ */
+
+// Mocked for the same reasons cors.test.ts gives: rate-limit wants a live
+// store, and @working-theory/email pulls an ESM-only transitive dep.
+jest.mock("@fastify/rate-limit", () => jest.fn().mockResolvedValue(undefined));
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; the DB boundary, mirrors auth.cookie-path.test.ts
+jest.mock("../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+const HUB = "https://hub.example";
+const SPOKE_A = "https://spoke-a.example";
+const ATTACKER = "https://attacker.example.net";
+const COOKIE = "better-auth.session_token=sess_tok_spoke.signature";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+type App = any;
+
+const ENV_KEYS = [
+  "FRONTEND_URL",
+  "AILK_TRUSTED_ORIGINS",
+  "NODE_ENV",
+  "DATABASE_URL",
+  // Cleared so a production boot never trips config's database-module exit.
+  "AILK_ENABLED_MODULES",
+] as const;
+
+describe("#7395 — a listed spoke's cookie write through build()", () => {
+  const priorEnv = new Map<string, string | undefined>(
+    ENV_KEYS.map((key) => [key, process.env[key]]),
+  );
+  let app: App;
+  let prisma: {
+    session: { findUnique: jest.Mock };
+    apiToken: { create: jest.Mock };
+  };
+
+  beforeEach(async () => {
+    process.env.FRONTEND_URL = HUB;
+    process.env.AILK_TRUSTED_ORIGINS = SPOKE_A;
+    process.env.NODE_ENV = "production";
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    delete process.env.AILK_ENABLED_MODULES;
+    jest.resetModules();
+
+    prisma = (require("../lib/prisma.js") as { prisma: typeof prisma }).prisma;
+    prisma.session.findUnique.mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_spoke_visitor",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+    prisma.apiToken.create.mockResolvedValue({
+      id: "tok_1",
+      name: "spoke",
+      tokenPrefix: "ailk_abc",
+      clientType: "cli",
+      scopes: [],
+      expiresAt: null,
+      createdAt: new Date(),
+    });
+
+    const { build } = require("../server") as typeof import("../server");
+    app = await build();
+  });
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    for (const [key, value] of priorEnv) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    jest.resetModules();
+  });
+
+  function postToken(origin: string) {
+    return app.inject({
+      method: "POST",
+      url: "/v1/auth/tokens",
+      headers: { cookie: COOKIE, origin },
+      payload: { name: "spoke" },
+    });
+  }
+
+  it("lets a cookie write from the listed spoke past the auth preHandler", async () => {
+    const res = await postToken(SPOKE_A);
+
+    expect(res.statusCode).not.toBe(401);
+    expect(res.json()).not.toEqual({ error: "unauthorized" });
+    // The handler ran as the session's user: the token was minted for them.
+    expect(res.statusCode).toBe(201);
+    expect(prisma.apiToken.create).toHaveBeenCalledTimes(1);
+    expect(prisma.apiToken.create.mock.calls[0][0].data.userId).toBe(
+      "usr_spoke_visitor",
+    );
+  });
+
+  it("refuses the same cookie write from an unlisted origin with 401", async () => {
+    const res = await postToken(ATTACKER);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+    expect(prisma.apiToken.create).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/__tests__/vercel-handler.test.ts

@@ -15,6 +15,11 @@
  *    string) instead of response.rawPayload corrupts any non-UTF-8 response
  *    by substituting U+FFFD for every invalid byte.
  *
+ * #7440 extends the request side: the adapter must forward the RAW bytes the
+ * client sent, not the parsed `req.body` — a signed webhook (Stripe, Slack,
+ * Cal.com) is verified over the exact bytes, and a re-serialization of the
+ * parse never matches a pretty-printed original.
+ *
  * The two request-side tests below drive a REAL minimal Fastify instance
  * through the handler — the defect lives inside Fastify's own
  * content-length check, so a mocked inject() cannot fail the way production
@@ -29,6 +34,9 @@
  * by every later test regardless of what that test wants build() to return.
  */
 
+import { createHmac } from 'node:crypto';
+import { PassThrough } from 'node:stream';
+
 import type { VercelRequest, VercelResponse } from '@vercel/node';
 import Fastify from 'fastify';
 
@@ -60,6 +68,47 @@ function asRequest(stub: MockVercelRequest): VercelRequest {
   return stub;
 }
 
+/**
+ * A body-carrying request the way the Vercel Node runtime hands it over: the
+ * runtime's helpers drain the stream to a Buffer, expose a lazily PARSED
+ * `req.body`, then replay the very same bytes through a PassThrough that only
+ * `on`/`addListener` for `data`/`end` reach (`restoreBody` in @vercel/node's
+ * serverless-functions helpers). The stub reproduces exactly that: an
+ * already-ended original stream with the replay patched over it, and `body`
+ * set to what the runtime's parser produced (`parsed`, default the JSON parse).
+ */
+function bodyRequest(fields: {
+  method?: string;
+  url: string;
+  headers: Record<string, string>;
+  raw: string;
+  parsed?: unknown;
+}): VercelRequest {
+  const original = new PassThrough();
+  original.end();
+  original.resume();
+  const replay = new PassThrough();
+  replay.end(Buffer.from(fields.raw));
+  const originalOn = original.on.bind(original);
+  const replayedOn = (name: string, cb: (...args: unknown[]) => void) =>
+    name === 'data' || name === 'end' ? replay.on(name, cb) : originalOn(name, cb);
+  const stub = Object.assign(original, {
+    read: replay.read.bind(replay),
+    on: replayedOn,
+    addListener: replayedOn,
+    method: fields.method ?? 'POST',
+    url: fields.url,
+    headers: fields.headers,
+    body: 'parsed' in fields ? fields.parsed : fields.raw ? JSON.parse(fields.raw) : {},
+    query: {},
+  });
+  // @ts-expect-error: a Readable carrying the fields above satisfies the
+  // subset of VercelRequest the handler reads (stream + method/url/headers/
+  // body/query); a full VercelRequest (extends http.IncomingMessage) cannot
+  // be constructed without a live connection.
+  return stub;
+}
+
 interface MockRes {
   headersSent: boolean;
   _status?: number;
@@ -134,19 +183,17 @@ describe('vercel-handler — request side: stale content-length (#5168)', () =>
 
     const body = { hello: 'world', nested: { a: 1 } };
     const pretty = JSON.stringify(body, null, 2);
-    const req: MockVercelRequest = {
-      method: 'POST',
+    const req = bodyRequest({
       url: '/echo',
       headers: {
         'content-type': 'application/json',
         'content-length': String(Buffer.byteLength(pretty)),
       },
-      body,
-      query: {},
-    };
+      raw: pretty,
+    });
     const res = makeRes();
 
-    await handler(asRequest(req), asResponse(res));
+    await handler(req, asResponse(res));
 
     expect(res._status).toBe(200);
     expect(JSON.parse(res._sent as string)).toEqual(body);
@@ -158,25 +205,199 @@ describe('vercel-handler — request side: stale content-length (#5168)', () =>
 
     const body = { hello: 'world' };
     const compactPlusNewline = JSON.stringify(body) + '\n';
-    const req: MockVercelRequest = {
-      method: 'POST',
+    const req = bodyRequest({
       url: '/echo',
       headers: {
         'content-type': 'application/json',
         'content-length': String(Buffer.byteLength(compactPlusNewline)),
       },
-      body,
-      query: {},
-    };
+      raw: compactPlusNewline,
+    });
     const res = makeRes();
 
-    await handler(asRequest(req), asResponse(res));
+    await handler(req, asResponse(res));
 
     expect(res._status).toBe(200);
     expect(JSON.parse(res._sent as string)).toEqual(body);
   });
 });
 
+// ── #7440: the signed bytes reach the verifier ──────────────────────────────
+//
+// Stripe signs the ORIGINAL bytes of the event — pretty-printed JSON — and the
+// adapter used to forward the runtime's PARSED `req.body`, which inject()
+// re-serialized compactly, so verifyWebhookSignature could never match on a
+// Vercel deployment. These tests mount the REAL Stripe receiver behind the
+// same raw-buffer parser server.ts scopes to the webhooks sub-router, and sign
+// with the REAL verifier's scheme — only the licence (commerce-claimed), the
+// analytics sink and Prisma are faked, none of which the verify path reads.
+
+jest.mock('@working-theory/license', () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: 'pro',
+    plan: 'pro-monthly',
+    features: ['commerce'],
+    expiresAt: null,
+    revoked: false,
+  }),
+  readStoredJwtState: jest.fn(),
+}));
+jest.mock('@working-theory/analytics/server', () => ({
+  track: jest.fn().mockResolvedValue(undefined),
+}));
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock('../lib/prisma.js');
+
+/** Stripe's v1 scheme: `t=<ts>,v1=<hex HMAC-SHA256(secret, "<ts>.<payload>")>`. */
+function stripeSignature(payload: string, secret: string): string {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const v1 = createHmac('sha256', secret).update(`${timestamp}.${payload}`).digest('hex');
+  return `t=${timestamp},v1=${v1}`;
+}
+
+describe('vercel-handler — raw bytes reach webhook verification (#7440)', () => {
+  let app: ReturnType<typeof Fastify>;
+
+  beforeEach(async () => {
+    jest.resetModules();
+    const { stripeWebhookHandler } = require('../routes/webhooks/stripe');
+    app = Fastify();
+    await app.register(async (webhooksScope) => {
+      webhooksScope.addContentTypeParser(
+        'application/json',
+        { parseAs: 'buffer' },
+        (_req, body, done) => {
+          done(null, body);
+        },
+      );
+      webhooksScope.addContentTypeParser(
+        'application/x-www-form-urlencoded',
+        { parseAs: 'buffer' },
+        (_req, body, done) => {
+          done(null, body);
+        },
+      );
+      webhooksScope.post('/v1/webhooks/stripe', stripeWebhookHandler);
+      webhooksScope.post('/v1/form-echo', async (req) => ({
+        raw: Buffer.isBuffer(req.body) ? req.body.toString('utf8') : null,
+      }));
+    });
+    app.post('/echo', async (req) => req.body);
+    await app.ready();
+    jest.doMock('../server', () => ({ build: jest.fn().mockResolvedValue(app) }));
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  function webhookSecret(): string {
+    const { config } = require('../config') as { config: { STRIPE_WEBHOOK_SECRET?: string } };
+    if (!config.STRIPE_WEBHOOK_SECRET) throw new Error('test setup sets STRIPE_WEBHOOK_SECRET');
+    return config.STRIPE_WEBHOOK_SECRET;
+  }
+
+  it('verifies a Stripe-signed, pretty-printed event and returns 200', async () => {
+    const handler = loadHandler();
+    // Stripe's own delivery format: indent=2, as every webhook body arrives.
+    const event = JSON.stringify(
+      {
+        id: 'evt_7440_pretty_printed',
+        object: 'event',
+        type: 'test.helper.unhandled',
+        created: 1_759_000_000,
+        data: { object: { id: 'obj_7440' } },
+      },
+      null,
+      2,
+    );
+    const req = bodyRequest({
+      url: '/v1/webhooks/stripe',
+      headers: {
+        'content-type': 'application/json; charset=utf-8',
+        'content-length': String(Buffer.byteLength(event)),
+        'stripe-signature': stripeSignature(event, webhookSecret()),
+      },
+      raw: event,
+    });
+    const res = makeRes();
+
+    await handler(req, asResponse(res));
+
+    expect(res._status).toBe(200);
+    expect(JSON.parse(String(res._sent))).toEqual({ received: true });
+  });
+
+  it('still rejects a body that differs from the signed bytes', async () => {
+    const handler = loadHandler();
+    const signed = JSON.stringify({ id: 'evt_7440_tampered', type: 'test.helper' }, null, 2);
+    const sent = signed.replace('evt_7440_tampered', 'evt_7440_tampereD');
+    const req = bodyRequest({
+      url: '/v1/webhooks/stripe',
+      headers: {
+        'content-type': 'application/json',
+        'stripe-signature': stripeSignature(signed, webhookSecret()),
+      },
+      raw: sent,
+    });
+    const res = makeRes();
+
+    await handler(req, asResponse(res));
+
+    expect(res._status).toBe(400);
+    expect(JSON.parse(String(res._sent))).toEqual({ error: 'signature-invalid' });
+  });
+
+  it('forwards a urlencoded body byte-for-byte to the raw-buffer scope (Slack)', async () => {
+    const handler = loadHandler();
+    const form = 'payload=%7B%22type%22%3A%22block_actions%22%7D&token=abc';
+    const req = bodyRequest({
+      url: '/v1/form-echo',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      raw: form,
+      parsed: { payload: '{"type":"block_actions"}', token: 'abc' },
+    });
+    const res = makeRes();
+
+    await handler(req, asResponse(res));
+
+    expect(res._status).toBe(200);
+    expect(JSON.parse(String(res._sent))).toEqual({ raw: form });
+  });
+
+  // The fallback re-serializes `{}` (2 bytes) against a declared length of 0,
+  // so this also guards the content-length strip (#5168).
+  it('keeps an empty JSON POST answering as it did (the runtime parse, `{}`)', async () => {
+    const handler = loadHandler();
+    const req = bodyRequest({
+      url: '/echo',
+      headers: { 'content-type': 'application/json', 'content-length': '0' },
+      raw: '',
+    });
+    const res = makeRes();
+
+    await handler(req, asResponse(res));
+
+    expect(res._status).toBe(200);
+    expect(JSON.parse(String(res._sent))).toEqual({});
+  });
+
+  it('keeps a POST with no content-type bodiless, as the runtime forwarded it', async () => {
+    const handler = loadHandler();
+    const req = bodyRequest({
+      url: '/echo',
+      headers: { 'content-length': '5' },
+      raw: 'hello',
+      parsed: undefined,
+    });
+    const res = makeRes();
+
+    await handler(req, asResponse(res));
+
+    expect(res._status).toBe(200);
+  });
+});
+
 describe('vercel-handler — response side: binary round-trip (#5168)', () => {
   beforeEach(() => {
     jest.resetModules();

package/templates/apps/api/src/config/__tests__/trusted-origins.test.ts

@@ -0,0 +1,238 @@
+/**
+ * @file trusted-origins.test.ts
+ * @description The trusted browser-origin allowlist (#7395 AC-2).
+ *
+ * `resolveTrustedOrigins` is the one derivation CORS, the cookie-forwarded
+ * write check and the checkout redirect lock all read (spec D2/D4). It takes
+ * `FRONTEND_URL` (lenient, as today) plus the opt-in `AILK_TRUSTED_ORIGINS`
+ * (strict: an entry must already be written exactly as a browser serialises
+ * an `Origin` header). A refused entry stops the process at startup (D3), and
+ * the refusal log names the entry's position and reason, never its text.
+ */
+
+// Mock dotenv so a developer's local .env never leaks into the config module.
+jest.mock('dotenv', () => ({
+  config: jest.fn(),
+}));
+
+const mockLoggerError = jest.fn();
+const mockLoggerWarn = jest.fn();
+jest.mock('@working-theory/observability', () => ({
+  logger: {
+    error: (...args: unknown[]) => mockLoggerError(...args),
+    warn: (...args: unknown[]) => mockLoggerWarn(...args),
+    info: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+import { resolveTrustedOrigins } from '../index';
+
+describe('resolveTrustedOrigins (#7395 D2)', () => {
+  it('normalises the primary, trims and de-duplicates the extras, and keeps first-seen order', () => {
+    const result = resolveTrustedOrigins({
+      FRONTEND_URL: 'https://hub.example/',
+      AILK_TRUSTED_ORIGINS:
+        ' https://admin.hub.example,https://spoke-a.example,,https://hub.example',
+      NODE_ENV: 'production',
+    });
+
+    expect(result.origins).toEqual([
+      'https://hub.example',
+      'https://admin.hub.example',
+      'https://spoke-a.example',
+    ]);
+    expect(result.refused).toEqual([]);
+    expect(result.primaryUnusable).toBe(false);
+    expect(Object.isFrozen(result.origins)).toBe(true);
+  });
+
+  it.each([
+    ['*', 'wildcard'],
+    ['https://*.example.com', 'wildcard'],
+    ['null', 'unparseable'],
+    ['https://a.example/', 'not-canonical'],
+    ['https://a.example/app', 'not-canonical'],
+    ['HTTPS://A.EXAMPLE', 'not-canonical'],
+    ['https://a.example:443', 'not-canonical'],
+    ['ftp://a.example', 'scheme'],
+    ['not a url', 'unparseable'],
+    ['https://user:pw@a.example', 'not-canonical'],
+    ['https://bücher.example', 'not-canonical'],
+    ['https://a.example.', 'trailing-dot'],
+    ['http://a.example', 'scheme'],
+  ])('refuses the extra %j in production (%s)', (entry, reason) => {
+    const result = resolveTrustedOrigins({
+      FRONTEND_URL: 'https://hub.example',
+      AILK_TRUSTED_ORIGINS: `https://ok.example,${entry}`,
+      NODE_ENV: 'production',
+    });
+
+    expect(result.refused).toEqual([{ position: 2, reason }]);
+    expect(result.origins).toEqual(['https://hub.example', 'https://ok.example']);
+  });
+
+  it('accepts a plain-http extra outside production', () => {
+    const result = resolveTrustedOrigins({
+      FRONTEND_URL: 'http://localhost:3000',
+      AILK_TRUSTED_ORIGINS: 'http://a.example',
+      NODE_ENV: 'development',
+    });
+
+    expect(result.refused).toEqual([]);
+    expect(result.origins).toEqual(['http://localhost:3000', 'http://a.example']);
+  });
+
+  it('carries no raw entry text in its result', () => {
+    const result = resolveTrustedOrigins({
+      FRONTEND_URL: 'https://hub.example',
+      AILK_TRUSTED_ORIGINS: 'https://user:pw@a.example',
+      NODE_ENV: 'production',
+    });
+
+    expect(JSON.stringify(result)).not.toContain('pw');
+  });
+
+  it.each([
+    'https://*',
+    // WHATWG decodes `%2A` in a host, so this parses to origin https://*.example.com.
+    'https://%2A.example.com',
+    'https://a.example,https://b.example',
+    'not a url',
+    'mailto:ops@example.com',
+  ])(
+    'a FRONTEND_URL of %j contributes no origin and is reported unusable',
+    (frontendUrl) => {
+      const result = resolveTrustedOrigins({
+        FRONTEND_URL: frontendUrl,
+        AILK_TRUSTED_ORIGINS: 'https://spoke-a.example',
+        NODE_ENV: 'production',
+      });
+
+      expect(result.origins).toEqual(['https://spoke-a.example']);
+      expect(result.primaryUnusable).toBe(true);
+      expect(result.refused).toEqual([]);
+    },
+  );
+
+  it('keeps a plain-http primary in production, as today', () => {
+    const result = resolveTrustedOrigins({
+      FRONTEND_URL: 'http://site.example',
+      NODE_ENV: 'production',
+    });
+
+    expect(result.origins).toEqual(['http://site.example']);
+    expect(result.primaryUnusable).toBe(false);
+  });
+
+  it('defaults an unset primary to http://localhost:3000 outside production', () => {
+    const result = resolveTrustedOrigins({ NODE_ENV: 'development' });
+
+    expect(result.origins).toEqual(['http://localhost:3000']);
+    expect(result.primaryUnusable).toBe(false);
+  });
+
+  it('trusts nothing for an unset primary in production, without reporting it unusable', () => {
+    const result = resolveTrustedOrigins({ NODE_ENV: 'production' });
+
+    expect(result.origins).toEqual([]);
+    expect(result.primaryUnusable).toBe(false);
+  });
+
+  it('trusts only the extras for an unset primary in production', () => {
+    const result = resolveTrustedOrigins({
+      AILK_TRUSTED_ORIGINS: 'https://hub.example',
+      NODE_ENV: 'production',
+    });
+
+    expect(result.origins).toEqual(['https://hub.example']);
+  });
+});
+
+describe('config.TRUSTED_ORIGINS at startup (#7395 D3/D5)', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...originalEnv };
+    // Cleared so a production boot never trips config's database-module exit.
+    delete process.env.AILK_ENABLED_MODULES;
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    jest.restoreAllMocks();
+  });
+
+  it('exposes the resolved, frozen list on config', () => {
+    process.env.FRONTEND_URL = 'https://hub.example/';
+    process.env.AILK_TRUSTED_ORIGINS = 'https://spoke-a.example';
+
+    const { config } = require('../index');
+
+    expect(config.TRUSTED_ORIGINS).toEqual(['https://hub.example', 'https://spoke-a.example']);
+    expect(Object.isFrozen(config.TRUSTED_ORIGINS)).toBe(true);
+    expect(config.AILK_TRUSTED_ORIGINS).toBe('https://spoke-a.example');
+    // FRONTEND_URL keeps its job as the primary site's address (D7).
+    expect(config.FRONTEND_URL).toBe('https://hub.example/');
+  });
+
+  it.each(['production', 'development'])(
+    'exits with a refused entry in %s, logging its position and reason but never its text',
+    (nodeEnv) => {
+      process.env.NODE_ENV = nodeEnv;
+      process.env.FRONTEND_URL = 'https://hub.example';
+      process.env.AILK_TRUSTED_ORIGINS = 'https://spoke-a.example,https://user:pw@a.example';
+      const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
+        throw new Error('Process exit called');
+      });
+      const consoleError = jest.spyOn(console, 'error').mockImplementation(() => undefined);
+
+      expect(() => require('../index')).toThrow('Process exit called');
+      expect(exitSpy).toHaveBeenCalledWith(1);
+      expect(mockLoggerError).toHaveBeenCalledTimes(1);
+
+      const logged = JSON.stringify([mockLoggerError.mock.calls, consoleError.mock.calls]);
+      expect(logged).toContain('AILK_TRUSTED_ORIGINS');
+      expect(logged).toContain('"position":2');
+      expect(logged).toContain('"reason":"not-canonical"');
+      expect(logged).not.toContain('pw');
+      expect(logged).not.toContain('a.example');
+      // The same line also reaches console.error, which survives a worker
+      // transport dropping the last line before exit (spec § 9 SA-08).
+      expect(consoleError).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it.each(['production', 'development'])(
+    'logs, without exiting or echoing it, a FRONTEND_URL that is set but unusable (%s)',
+    (nodeEnv) => {
+      process.env.NODE_ENV = nodeEnv;
+      process.env.FRONTEND_URL = 'https://secret-token*@hub.example';
+      delete process.env.AILK_TRUSTED_ORIGINS;
+      const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
+        throw new Error('Process exit called');
+      });
+
+      const { config } = require('../index');
+
+      expect(exitSpy).not.toHaveBeenCalled();
+      expect(config.TRUSTED_ORIGINS).toEqual([]);
+      expect(mockLoggerError).toHaveBeenCalledTimes(1);
+      const logged = JSON.stringify(mockLoggerError.mock.calls);
+      expect(logged).toContain('FRONTEND_URL is set but');
+      expect(logged).not.toContain('secret-token');
+    },
+  );
+
+  it('logs no error for a usable FRONTEND_URL and no extras', () => {
+    process.env.FRONTEND_URL = 'https://hub.example';
+    delete process.env.AILK_TRUSTED_ORIGINS;
+
+    const { config } = require('../index');
+
+    expect(config.TRUSTED_ORIGINS).toEqual(['https://hub.example']);
+    expect(mockLoggerError).not.toHaveBeenCalled();
+  });
+});