feat: enforce production pricing provider config

apps/api/tests/application/pricing-provider.test.js

@@ -6,7 +6,10 @@ import {
   createPricingProviderRegistry,
 } from "../../src/modules/pricing/providers/pricing-provider.js";
 import { createFixturePricingProvider } from "../../src/modules/pricing/providers/fixture-pricing-provider.js";
-import { createHttpPricingProvider } from "../../src/modules/pricing/providers/http-pricing-provider.js";
+import {
+  assertProductionPricingProviderConfig,
+  createHttpPricingProvider,
+} from "../../src/modules/pricing/providers/http-pricing-provider.js";
 
 test("registers pricing providers behind a validated adapter contract", async () => {
   const provider = createPricingProvider({
@@ -78,6 +81,25 @@ test("http provider rejects insecure or malformed external provider URLs", () =>
   );
 });
 
+test("requires a secure external provider in production", () => {
+  assert.throws(
+    () => assertProductionPricingProviderConfig({ fixtureEnabled: true, endpoint: "https://provider.example/prices" }),
+    /fixture pricing provider must be disabled/i,
+  );
+  assert.throws(
+    () => assertProductionPricingProviderConfig({ fixtureEnabled: false, endpoint: "" }),
+    /endpoint is required/i,
+  );
+  assert.throws(
+    () => assertProductionPricingProviderConfig({ fixtureEnabled: false, endpoint: "http://provider.example/prices" }),
+    /must use HTTPS/i,
+  );
+  assert.doesNotThrow(() => assertProductionPricingProviderConfig({
+    fixtureEnabled: false,
+    endpoint: "https://provider.example/prices",
+  }));
+});
+
 test("http provider sends mapping context and normalizes its response", async () => {
   let request;
   const provider = createHttpPricingProvider({