express: restrict test credentials to test envs (enketo#1378)

Co-authored-by: alxndrsn <alxndrsn>
lognaturel · Dec 3, 2024 · 1e8821e · 1e8821e
1 parent 0bdd2b3
commit 1e8821e
Showing 1 changed file with 32 additions and 29 deletions.
diff --git a/packages/enketo-express/app/models/account-model.js b/packages/enketo-express/app/models/account-model.js
@@ -41,36 +41,39 @@ function get(survey) {
 
         return Promise.reject(error);
     }
-    if (/https?:\/\/testserver.com\/bob/.test(server)) {
-        return Promise.resolve({
-            linkedServer: server,
-            key: 'abc',
-            quota: 100,
-        });
-    }
-    if (/https?:\/\/testserver.com\/noquota/.test(server)) {
-        error = new Error('Forbidden. No quota left.');
-        error.status = 403;
-
-        return Promise.reject(error);
-    }
-    if (/https?:\/\/testserver.com\/noapi/.test(server)) {
-        error = new Error('Forbidden. No API access granted.');
-        error.status = 405;
 
-        return Promise.reject(error);
-    }
-    if (/https?:\/\/testserver.com\/noquotanoapi/.test(server)) {
-        error = new Error('Forbidden. No API access granted.');
-        error.status = 405;
-
-        return Promise.reject(error);
-    }
-    if (/https?:\/\/testserver.com\/notpaid/.test(server)) {
-        error = new Error('Forbidden. The account is not active.');
-        error.status = 403;
-
-        return Promise.reject(error);
+    if (process.env.NODE_ENV === 'test') {
+        if (/https?:\/\/testserver.com\/bob/.test(server)) {
+            return Promise.resolve({
+                linkedServer: server,
+                key: 'abc',
+                quota: 100,
+            });
+        }
+        if (/https?:\/\/testserver.com\/noquota/.test(server)) {
+            error = new Error('Forbidden. No quota left.');
+            error.status = 403;
+
+            return Promise.reject(error);
+        }
+        if (/https?:\/\/testserver.com\/noapi/.test(server)) {
+            error = new Error('Forbidden. No API access granted.');
+            error.status = 405;
+
+            return Promise.reject(error);
+        }
+        if (/https?:\/\/testserver.com\/noquotanoapi/.test(server)) {
+            error = new Error('Forbidden. No API access granted.');
+            error.status = 405;
+
+            return Promise.reject(error);
+        }
+        if (/https?:\/\/testserver.com\/notpaid/.test(server)) {
+            error = new Error('Forbidden. The account is not active.');
+            error.status = 403;
+
+            return Promise.reject(error);
+        }
     }
 
     return _getAccount(server);