Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/platformsettings/service_test.go

@@ -0,0 +1,109 @@
+package platformsettings
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestEncryptDecryptRoundTrip(t *testing.T) {
+	key := DeriveKey("test-platform-secret-key-material", "fallback")
+	if len(key) != 32 {
+		t.Fatalf("key len %d", len(key))
+	}
+	enc, err := EncryptSecret(key, "sk_live_secret_value")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(enc, encPrefix) {
+		t.Fatalf("expected enc prefix, got %q", enc)
+	}
+	plain, err := DecryptSecret(key, enc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plain != "sk_live_secret_value" {
+		t.Fatalf("got %q", plain)
+	}
+}
+
+func TestParseDuration(t *testing.T) {
+	d, ok := parseDuration("10s")
+	if !ok || d != 10*time.Second {
+		t.Fatalf("10s -> %v ok=%v", d, ok)
+	}
+	d, ok = parseDuration("5")
+	if !ok || d != 5*time.Second {
+		t.Fatalf("5 -> %v ok=%v", d, ok)
+	}
+}
+
+func TestSecretValueKeys(t *testing.T) {
+	if !isSecretValueKey(KeyStripeSecretKey) {
+		t.Fatal("stripe secret should be secret")
+	}
+	if !isSecretValueKey(KeyEPRELAPIKey) {
+		t.Fatal("eprel api key should be secret")
+	}
+	if !isSecretValueKey(KeyPineconeAPIKey) {
+		t.Fatal("pinecone.api_key should be secret")
+	}
+	if !isSecretValueKey(ValueKeyResendAPIKey) {
+		t.Fatal("mail.resend_api_key should be secret")
+	}
+	if isSecretValueKey(KeyPineconeHost) {
+		t.Fatal("pinecone.host should not be secret")
+	}
+	if isSecretValueKey(KeyStripeMock) {
+		t.Fatal("stripe.mock should not be secret")
+	}
+}
+
+func TestAllowedValueKeys(t *testing.T) {
+	if !isAllowedValueKey(KeyEPRELFicheLanguage) {
+		t.Fatal("eprel.fiche_language must be allowed")
+	}
+	if isAllowedValueKey("evil.injection") {
+		t.Fatal("unknown keys must be rejected")
+	}
+}
+
+func TestNormalizeEPRELFicheLanguage(t *testing.T) {
+	got, err := NormalizeEPRELFicheLanguage(" de ")
+	if err != nil || got != "DE" {
+		t.Fatalf("got %q err=%v", got, err)
+	}
+	if _, err := NormalizeEPRELFicheLanguage("xx"); err == nil {
+		t.Fatal("expected error for unsupported language")
+	}
+}
+
+func TestResolvePinecone_envOnly(t *testing.T) {
+	svc := NewService(nil, EnvConfig{
+		PineconeAPIKey:    "pc-env-key",
+		PineconeHost:      "https://index.svc.pinecone.io",
+		PineconeNamespace: "ns-env",
+	})
+	got, err := svc.ResolvePinecone(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.Configured() {
+		t.Fatal("expected configured")
+	}
+	if got.APIKey != "pc-env-key" || got.Host != "https://index.svc.pinecone.io" || got.Namespace != "ns-env" {
+		t.Fatalf("got %+v", got)
+	}
+}
+
+func TestResolvePinecone_unset(t *testing.T) {
+	svc := NewService(nil, EnvConfig{})
+	got, err := svc.ResolvePinecone(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Configured() {
+		t.Fatalf("expected unset, got %+v", got)
+	}
+}