Merge pull request #2 from gosuda/dev

fix(server): default serve script to explicit development mode

Author: metaphorics

README.md

@@ -26,7 +26,7 @@ bun run serve
 bun run dev
 ```
 
-The development fallback secret is intentionally insecure. Set `TGB_SECRET` to at least 16 characters for a real deployment; production mode refuses to start without it. Set `TGB_DATA_DIR` to move persistent tenant data outside the repository.
+The development fallback secret is intentionally insecure, and `bun run serve` defaults to explicit development mode so the local quickstart uses it with a loud warning. Any other invocation refuses to start unless `TGB_SECRET` is at least 16 characters or the mode is explicitly development/test; production mode always refuses to start without a strong `TGB_SECRET`. Set `TGB_DATA_DIR` to move persistent tenant data outside the repository.
 
 ## Commands
 

package.json

@@ -6,7 +6,7 @@
   "license": "Elastic-2.0",
   "scripts": {
     "dev": "vite",
-    "serve": "bun run server/index.ts",
+    "serve": "TGB_ENV=\"${TGB_ENV:-development}\" bun run server/index.ts",
     "build": "vite build && bun run scripts/build-runtime.ts && bun run scripts/build-games.ts",
     "build:wasm": "bun run scripts/build-wasm.ts",
     "typecheck": "tsc --noEmit",

server/auth.test.ts

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { afterEach, describe, expect, test, vi } from "vitest";
 import { issueToken } from "@/agentapi/credentials";
 import type { CredentialClaims } from "@/model/types";
@@ -76,4 +77,11 @@ describe("server bearer auth", () => {
     expect(() => loadSecret({ NODE_ENV: "development", TGB_SECRET: "short" })).not.toThrow();
     expect(loadSecret({ NODE_ENV: "production", TGB_SECRET: SECRET })).toBe(SECRET);
   });
+
+  test("serve script opts into explicit development mode without overriding an operator's TGB_ENV", () => {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as {
+      scripts: Record<string, string>;
+    };
+    expect(pkg.scripts.serve).toContain('TGB_ENV="$' + '{TGB_ENV:-development}"');
+  });
 });