From a5a261fa376828e1b5fa92061d29e5b0ebd388d9 Mon Sep 17 00:00:00 2001
From: nexxo <nexxo@clupilot.local>
Date: Sat, 25 Jul 2026 21:24:42 +0200
Subject: [PATCH] test: pin APP_URL/ADMIN_HOSTS so the suite does not follow
 deployment env

Setting the real APP_URL made route() build https://app.dev.clupilot.com/...,
which ADMIN_HOSTS does not list, so 30 admin tests 404'd. The suite must not
depend on operator hostnames.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 phpunit.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/phpunit.xml b/phpunit.xml
index 1df375b..dc686d3 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -21,6 +21,12 @@
         <!-- force=true so these override the dev .env that docker-compose injects
              as real container env vars (otherwise tests use redis/mariadb). -->
         <env name="APP_ENV" value="testing" force="true"/>
+        <!-- Pinned so the suite never depends on the operator's real hostnames:
+             route() builds URLs from APP_URL, and a deployment-specific
+             ADMIN_HOSTS would then 404 every admin route. Tests that exercise
+             the restriction set admin_access.hosts themselves. -->
+        <env name="APP_URL" value="http://localhost" force="true"/>
+        <env name="ADMIN_HOSTS" value="" force="true"/>
         <env name="APP_MAINTENANCE_DRIVER" value="file"/>
         <env name="BCRYPT_ROUNDS" value="4" force="true"/>
         <env name="BROADCAST_CONNECTION" value="null" force="true"/>