fix

apps/api/internal/config/config_test.go

@@ -217,6 +217,61 @@ func TestProductionValidateFailsClosed(t *testing.T) {
 	}
 }
 
+func TestProductionLoopbackWebOriginEscape(t *testing.T) {
+	base := Config{
+		AppEnv:                 "production",
+		WebOrigin:              "http://localhost:28472",
+		SessionSecure:          false,
+		AppEncryptionKey:       "enc",
+		TokenSigningSecret:     "tok",
+		ProcessingPollInterval: 250 * time.Millisecond,
+		DBMaxConns:             20,
+		DBMinConns:             2,
+		DBMaxConnLifetime:      time.Hour,
+		DBMaxConnIdleTime:      5 * time.Minute,
+		DBHealthCheckPeriod:    time.Minute,
+		DBStatementTimeout:     30 * time.Second,
+	}
+
+	denied := base
+	if err := denied.validate(); err == nil {
+		t.Fatal("expected http loopback WEB_ORIGIN rejected without escape")
+	} else if !strings.Contains(err.Error(), "ALLOW_INSECURE_LOCAL_PRODUCTION") {
+		t.Fatalf("error should mention escape hatch: %v", err)
+	}
+
+	allowed := base
+	allowed.AllowInsecureLocalProduction = true
+	if err := allowed.validate(); err != nil {
+		t.Fatal(err)
+	}
+	if !allowed.InsecureLocalProductionActive() {
+		t.Fatal("expected insecure local production active")
+	}
+	if allowed.CookieSecure() {
+		t.Fatal("http loopback escape should not force CookieSecure")
+	}
+
+	httpsLocal := allowed
+	httpsLocal.WebOrigin = "https://localhost:28472"
+	if err := httpsLocal.validate(); err == nil {
+		t.Fatal("expected SESSION_SECURE required for https loopback escape")
+	}
+	httpsLocal.SessionSecure = true
+	if err := httpsLocal.validate(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Escape must not weaken public (non-loopback) http.
+	publicHTTP := base
+	publicHTTP.AllowInsecureLocalProduction = true
+	publicHTTP.WebOrigin = "http://app.example.com"
+	publicHTTP.SessionSecure = true
+	if err := publicHTTP.validate(); err == nil {
+		t.Fatal("expected public http WEB_ORIGIN rejected even with escape flag")
+	}
+}
+
 func TestValidateSMTPEnabledDoesNotRequireEnvHost(t *testing.T) {
 	// SMTP credentials live in admin platform settings; boot must succeed with SMTP_ENABLED=true and empty host.
 	cfg := Config{
@@ -298,6 +353,15 @@ func TestCookieSecure(t *testing.T) {
 	if (Config{AppEnv: "development", SessionSecure: false}).CookieSecure() {
 		t.Fatal("development without SessionSecure should not enable CookieSecure")
 	}
+	insecureLocal := Config{
+		AppEnv:                       "production",
+		WebOrigin:                    "http://localhost:28472",
+		AllowInsecureLocalProduction: true,
+		SessionSecure:                false,
+	}
+	if insecureLocal.CookieSecure() {
+		t.Fatal("insecure local production http escape should not force CookieSecure")
+	}
 }
 
 func TestLoadSessionSecureDefaultsWithAppEnv(t *testing.T) {