Add failing tests for #652: purchase CORS violation & mock API in production

tests/core/test_cloud.py

@@ -572,3 +572,86 @@
                 "AuthError in async context should reference 'pdd auth login', "
                 f"not 'pdd login'. Got: {printed}"
             )
+
+
+# --- Issue #652: Cloud endpoint registry must include purchase endpoint ---
+
+def test_cloud_endpoints_include_purchase_endpoint():
+    """Test that CLOUD_ENDPOINTS includes the processPddcPurchase endpoint.
+
+    Issue #652: The purchase flow fails because processPddcPurchase is not registered
+    in the CLOUD_ENDPOINTS map, meaning the endpoint URL cannot be properly resolved
+    and requests may be routed incorrectly or use mock handlers instead.
+    """
+    assert "processPddcPurchase" in CLOUD_ENDPOINTS, (
+        f"'processPddcPurchase' must be registered in CLOUD_ENDPOINTS. "
+        f"Available endpoints: {list(CLOUD_ENDPOINTS.keys())}"
+    )
+
+
+def test_purchase_endpoint_url_resolves_to_production(clean_env):
+    """Test that processPddcPurchase resolves to the production cloud function URL.
+
+    Issue #652: The purchase endpoint must resolve to the real cloud function URL,
+    not a mock or missing URL. The expected production URL is:
+    https://us-central1-prompt-driven-development.cloudfunctions.net/processPddcPurchase
+    """
+    url = CloudConfig.get_endpoint_url("processPddcPurchase")
+
+    assert "us-central1-prompt-driven-development.cloudfunctions.net" in url, (
+        f"Purchase endpoint must resolve to production cloud functions URL. Got: {url}"
+    )
+    assert "processPddcPurchase" in url, (
+        f"Purchase endpoint URL must contain 'processPddcPurchase'. Got: {url}"
+    )
+    assert not any(mock_indicator in url.lower() for mock_indicator in ["mock", "localhost", "127.0.0.1"]), (
+        f"Purchase endpoint URL must not contain mock/local indicators. Got: {url}"
+    )
+
+
+def test_purchase_endpoint_not_mock_fallback(clean_env):
+    """Test that processPddcPurchase doesn't fall through to the unknown endpoint default.
+
+    When an endpoint is not in CLOUD_ENDPOINTS, get_endpoint_url() falls back to
+    /{name}. For processPddcPurchase, this means it's not explicitly registered,
+    which is a sign that mock handlers may be used instead of the real endpoint.
+    """
+    # If processPddcPurchase is properly registered, its path should be in CLOUD_ENDPOINTS
+    endpoint_path = CLOUD_ENDPOINTS.get("processPddcPurchase")
+    assert endpoint_path is not None, (
+        "'processPddcPurchase' is not in CLOUD_ENDPOINTS — it falls through to the "
+        "default /{name} pattern, indicating the endpoint is not properly registered. "
+        "This can cause mock handlers to be used in production."
+    )
+    assert endpoint_path == "/processPddcPurchase", (
+        f"processPddcPurchase endpoint path should be '/processPddcPurchase'. Got: {endpoint_path}"
+    )
+
+
+def test_cloud_endpoints_completeness_for_billing():
+    """Test that all billing/payment-related endpoints are registered.
+
+    Issue #652: Mock API handlers were active in production because the payment
+    endpoints were not registered in the CLOUD_ENDPOINTS registry.
+    """
+    billing_endpoints = ["processPddcPurchase"]
+    missing = [ep for ep in billing_endpoints if ep not in CLOUD_ENDPOINTS]
+    assert not missing, (
+        f"Billing endpoints missing from CLOUD_ENDPOINTS: {missing}. "
+        f"Missing endpoints may fall back to mock handlers in production."
+    )
+
+
+def test_environment_detection_defaults_to_production(clean_env):
+    """Test that environment defaults to production when no overrides are set.
+
+    Issue #652: Mock APIs were active in production, suggesting the environment
+    detection may not be defaulting to production correctly.
+    """
+    # Simulate getting JWT token (which triggers _ensure_default_env)
+    with patch.dict(os.environ, {PDD_JWT_TOKEN_ENV: "ey.test.token"}, clear=True):
+        CloudConfig.get_jwt_token()
+        assert os.environ.get("PDD_ENV") == "prod", (
+            f"PDD_ENV should default to 'prod' when no overrides are set. "
+            f"Got: {os.environ.get('PDD_ENV')}"
+        )

tests/server/test_security.py

@@ -373,5 +373,87 @@
 
     s.add(is_blacklisted)
     s.add(z3.Not(rejected))
-
-    assert s.check() == z3.unsat
+
+    assert s.check() == z3.unsat
+
+
+# --- Issue #652: CORS must support production origins ---
+
+def test_configure_cors_includes_production_origin():
+    """Test that default CORS config includes the production origin (https://promptdriven.ai).
+
+    Issue #652: The purchase flow on promptdriven.ai fails with a CORS violation because
+    the CORS middleware only allows localhost origins by default, blocking requests from
+    the production domain.
+
+    This test fails on the buggy code because configure_cors() defaults to only
+    localhost:3000 and localhost:5173 origins.
+    """
+    app = MagicMock(spec=FastAPI)
+    configure_cors(app)
+
+    call_args = app.add_middleware.call_args
+    kwargs = call_args[1]
+    origins = kwargs["allow_origins"]
+
+    assert "https://promptdriven.ai" in origins, (
+        f"Production origin 'https://promptdriven.ai' must be in default CORS origins. "
+        f"Got: {origins}"
+    )
+
+
+def test_configure_cors_allows_production_https():
+    """Test that CORS configuration supports HTTPS production origins.
+
+    Issue #652: Browser preflight requests from https://promptdriven.ai are blocked
+    because Access-Control-Allow-Origin header doesn't include the production domain.
+    """
+    app = MagicMock(spec=FastAPI)
+    configure_cors(app)
+
+    call_args = app.add_middleware.call_args
+    kwargs = call_args[1]
+    origins = kwargs["allow_origins"]
+
+    has_production = any(
+        origin.startswith("https://") and "promptdriven" in origin
+        for origin in origins
+    )
+    assert has_production, (
+        f"CORS config must include at least one production HTTPS origin for promptdriven.ai. "
+        f"Got only: {origins}"
+    )
+
+
+def test_configure_cors_localhost_still_present():
+    """Test that localhost origins remain after adding production origins.
+
+    Ensures backward compatibility: adding production origins should not remove
+    the existing localhost development origins.
+    """
+    app = MagicMock(spec=FastAPI)
+    configure_cors(app)
+
+    call_args = app.add_middleware.call_args
+    kwargs = call_args[1]
+    origins = kwargs["allow_origins"]
+
+    assert "http://localhost:3000" in origins
+    assert "http://localhost:5173" in origins or "http://127.0.0.1:5173" in origins
+
+
+def test_configure_cors_rejects_unconfigured_origin():
+    """Test that CORS does not use a wildcard (*) that would allow any origin.
+
+    Security: CORS should explicitly list allowed origins, not use '*'.
+    """
+    app = MagicMock(spec=FastAPI)
+    configure_cors(app)
+
+    call_args = app.add_middleware.call_args
+    kwargs = call_args[1]
+    origins = kwargs["allow_origins"]
+
+    assert "*" not in origins, (
+        "CORS should not use wildcard '*' — explicit origins are required for security."
+    )