test(lifecycle): add tests for lifecycle endpoint

This commit introduces a new test file for the account lifecycle cron.

It includes tests for both private and public HTTP origins.

Additionally, it checks for unsafe and insecure origins to ensure proper validation.

Author: VictoriousWealth

scripts/run-account-lifecycle-cron.test.mjs

@@ -0,0 +1,64 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { lifecycleEndpoint } from "./run-account-lifecycle-cron.mjs";
+
+const CRON_SECRET = "a".repeat(32);
+
+test("uses a Railway-private HTTP origin when configured", () => {
+  const result = lifecycleEndpoint({
+    ACCOUNT_LIFECYCLE_CRON_ORIGIN:
+      "http://study-buddy-v2.railway.internal:8080/",
+    ACCOUNT_DELETION_CRON_SECRET: CRON_SECRET,
+  });
+
+  assert.equal(
+    result.endpoint.toString(),
+    "http://study-buddy-v2.railway.internal:8080/api/v1/account/deletion/cron"
+  );
+  assert.equal(result.cronSecret, CRON_SECRET);
+});
+
+test("falls back to the public HTTPS app origin", () => {
+  const result = lifecycleEndpoint({
+    APP_ORIGIN: "https://staging.studybuddyng.com/",
+    ACCOUNT_DELETION_CRON_SECRET: CRON_SECRET,
+  });
+
+  assert.equal(
+    result.endpoint.toString(),
+    "https://staging.studybuddyng.com/api/v1/account/deletion/cron"
+  );
+});
+
+for (const origin of [
+  "http://example.com:8080",
+  "https://study-buddy-v2.railway.internal:8080",
+  "http://railway.internal:8080",
+  "http://study-buddy-v2.railway.internal.example.com:8080",
+  "http://user:password@study-buddy-v2.railway.internal:8080",
+  "http://study-buddy-v2.railway.internal:8080/unexpected-path",
+  "http://study-buddy-v2.railway.internal:8080/?unexpected=query",
+]) {
+  test(`rejects unsafe private cron origin ${origin}`, () => {
+    assert.throws(
+      () =>
+        lifecycleEndpoint({
+          ACCOUNT_LIFECYCLE_CRON_ORIGIN: origin,
+          ACCOUNT_DELETION_CRON_SECRET: CRON_SECRET,
+        }),
+      /ACCOUNT_LIFECYCLE_CRON_ORIGIN/
+    );
+  });
+}
+
+test("still rejects insecure public fallback origins", () => {
+  assert.throws(
+    () =>
+      lifecycleEndpoint({
+        APP_ORIGIN: "http://staging.studybuddyng.com",
+        ACCOUNT_DELETION_CRON_SECRET: CRON_SECRET,
+      }),
+    /APP_ORIGIN_MUST_USE_HTTPS/
+  );
+});