feat(frontend): support static website demo mode

frontend/tests/unit/core/auth/server.test.ts

@@ -0,0 +1,77 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+import { STATIC_WEBSITE_USER } from "@/core/auth/static-user";
+
+vi.mock("next/headers", () => ({
+  cookies: vi.fn(() => {
+    throw new Error("cookies should not be read in static website mode");
+  }),
+}));
+
+const ENV_KEYS = [
+  "DEER_FLOW_AUTH_DISABLED",
+  "NEXT_PUBLIC_STATIC_WEBSITE_ONLY",
+] as const;
+
+type EnvSnapshot = Partial<
+  Record<(typeof ENV_KEYS)[number], string | undefined>
+>;
+
+function snapshotEnv(): EnvSnapshot {
+  const snapshot: EnvSnapshot = {};
+  for (const key of ENV_KEYS) {
+    snapshot[key] = process.env[key];
+  }
+  return snapshot;
+}
+
+function setEnv(key: (typeof ENV_KEYS)[number], value: string | undefined) {
+  const env = process.env as Record<string, string | undefined>;
+  if (value === undefined) {
+    delete env[key];
+  } else {
+    env[key] = value;
+  }
+}
+
+function restoreEnv(snapshot: EnvSnapshot) {
+  for (const key of ENV_KEYS) {
+    setEnv(key, snapshot[key]);
+  }
+}
+
+async function loadFreshServerAuth() {
+  vi.resetModules();
+  return await import("@/core/auth/server");
+}
+
+describe("getServerSideUser", () => {
+  let saved: EnvSnapshot;
+
+  beforeEach(() => {
+    saved = snapshotEnv();
+    setEnv("DEER_FLOW_AUTH_DISABLED", undefined);
+    setEnv("NEXT_PUBLIC_STATIC_WEBSITE_ONLY", undefined);
+  });
+
+  afterEach(() => {
+    restoreEnv(saved);
+    vi.unstubAllGlobals();
+  });
+
+  test("bypasses gateway auth in static website mode", async () => {
+    setEnv("NEXT_PUBLIC_STATIC_WEBSITE_ONLY", "true");
+    const fetchSpy = vi.fn(() => {
+      throw new Error("fetch should not be called in static website mode");
+    });
+    vi.stubGlobal("fetch", fetchSpy);
+
+    const { getServerSideUser } = await loadFreshServerAuth();
+
+    await expect(getServerSideUser()).resolves.toEqual({
+      tag: "authenticated",
+      user: STATIC_WEBSITE_USER,
+    });
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});