Harden gameplay timing and map loading

tests/runtime-config.test.ts

@@ -0,0 +1,69 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { validateRuntime } from "../scripts/runtime-config.mjs";
+const env = {
+  NEXT_PUBLIC_SUPABASE_URL: "https://project.supabase.co",
+  NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: "sb_publishable_example",
+  SUPABASE_SECRET_KEY: "sb_secret_example",
+  MINEGEO_URL: "https://minegeo.example",
+};
+test("production startup rejects CSRF bypass, secret exposure and missing config", () => {
+  assert.throws(
+    () =>
+      validateRuntime(
+        { ...env, MINEGEO_ALLOW_ANY_ORIGIN: "true" },
+        { production: true },
+      ),
+    /must be false/,
+  );
+  assert.throws(
+    () =>
+      validateRuntime({
+        ...env,
+        NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: env.SUPABASE_SECRET_KEY,
+      }),
+    /server secret/,
+  );
+  assert.throws(
+    () => validateRuntime({ ...env, SUPABASE_SECRET_KEY: "" }),
+    /Missing configuration.*SUPABASE_SECRET_KEY/,
+  );
+});
+test("production requires a secure public origin while allowing local production checks", () => {
+  for (const url of [
+    "http://minegeo.example",
+    "https://user:pass@minegeo.example",
+    "https://minegeo.example/path",
+    "https://minegeo.example?x=1",
+  ])
+    assert.throws(
+      () => validateRuntime({ ...env, MINEGEO_URL: url }, { production: true }),
+      /HTTPS origin/,
+    );
+  assert.equal(
+    validateRuntime(
+      { ...env, MINEGEO_URL: "http://localhost:3000" },
+      { production: true },
+    ).workerHeap,
+    4096,
+  );
+  assert.equal(validateRuntime(env, { production: true }).workerHeap, 4096);
+});
+test("startup validates worker heap and panorama size before spawning processes", () => {
+  assert.throws(
+    () => validateRuntime({ ...env, MINEGEO_WORKER_HEAP_MB: "NaN" }),
+    /WORKER_HEAP/,
+  );
+  assert.throws(
+    () => validateRuntime({ ...env, MINEGEO_FACE_SIZE: "8192" }),
+    /FACE_SIZE/,
+  );
+  assert.equal(
+    validateRuntime({
+      ...env,
+      MINEGEO_WORKER_HEAP_MB: "2048",
+      MINEGEO_FACE_SIZE: "256",
+    }).workerHeap,
+    2048,
+  );
+});