[DeJune06]

Summary

Adds real unit test coverage for the Stellar SDK configuration helpers and the per-route body size limits config. A third issue in this batch (#597, SSRF guard tests) was checked against main first and found already fully covered by the existing tests/unit/utils/ssrf-guard.test.ts, so no redundant tests were added for it.

closes #604
closes #605
closes #597
closes #610

Changes

• Add unit tests for Stellar config #604 — Add unit tests for Stellar config: added tests/unit/config/stellar.test.ts covering getNetworkPassphrase() (testnet/mainnet/default), getHorizonServer() and getSorobanServer() (correct URL wiring, new instance per call), and getPlatformKeypair() (loads from STELLAR_PLATFORM_SECRET, singleton caching, correct public key derivation). Follows the existing vi.resetModules() + fresh-env-import pattern already used in tests/unit/config/cors-origins.test.ts.
• Add unit tests for route body limits config #605 — Add unit tests for route body limits config: added tests/unit/config/route-body-limits.test.ts asserting the exact byte values for profileUpdate, courseImport, quizAuthoring, webhookCreate, their relative ordering, and that each limit is wired into the route module that's supposed to use it (user.routes.ts, webhook.routes.ts, admin-course.routes.ts), by asserting the source references the right ROUTE_BODY_LIMITS key.

Not included

• Add unit tests for SSRF guard utility #597 — Add unit tests for SSRF guard utility: already fully satisfied on main. The existing tests/unit/utils/ssrf-guard.test.ts covers private IPv4 ranges (10.x, 172.16.x, 192.168.x), loopback, the cloud metadata endpoint, the unspecified address, localhost and subdomains, IPv6 loopback/link-local, valid public URLs, and malformed URLs — matching every item in the issue's acceptance criteria. "DNS rebinding protection" from the issue's scope isn't implemented in src/utils/ssrf-guard.ts by design (the module's own doc comment explains this is a deliberate limitation, since it would require a dispatch-time check rather than a URL-validation-time one), so there's no such behavior to test. No changes made for this issue.

Test plan

• npx vitest run tests/unit/config/stellar.test.ts tests/unit/config/route-body-limits.test.ts — 21/21 passing.
• npx eslint tests/unit/config/stellar.test.ts tests/unit/config/route-body-limits.test.ts — clean.
• Verified .env.test-dependent config tests weren't broken by diffing failure counts with and without these two files present; the two new files introduce zero new failures.

---

tsc --noEmit -p tsconfig.test.json reports a pre-existing import.meta CommonJS error on my route-body-limits.test.ts, matching the identical pre-existing pattern already present in tests/unit/config/test-mode-required-vars.test.ts on main — this is a repo-wide tsconfig/vitest-vs-tsc mismatch, not something introduced here, and vitest run (the actual test runner) has no issue with it.

[drips-wave]

@DeJune06 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits