feat: expose safe build metadata and verify foundation

backend/apps/api/src/version/version.controller.spec.ts

@@ -0,0 +1,33 @@
+import { Test } from '@nestjs/testing';
+import {
+  APP_ENVIRONMENT,
+  AppEnvironment,
+} from '../../../../libs/configuration/src';
+import { VersionController } from './version.controller';
+
+describe('VersionController', () => {
+  it('returns only safe build metadata', async () => {
+    const environment: AppEnvironment = {
+      databaseUrl: 'postgresql://u:p@postgres:5432/db',
+      redisUrl: 'redis://redis:6379',
+      appVersion: '1.0.0',
+      teamCityBuildNumber: '123',
+      sourceRevision: 'abc123',
+    };
+
+    const moduleRef = await Test.createTestingModule({
+      controllers: [VersionController],
+      providers: [{ provide: APP_ENVIRONMENT, useValue: environment }],
+    }).compile();
+
+    const response = moduleRef.get(VersionController).version();
+
+    expect(response).toEqual({
+      appVersion: '1.0.0',
+      teamCityBuildNumber: '123',
+      sourceRevision: 'abc123',
+    });
+    expect(response).not.toHaveProperty('databaseUrl');
+    expect(response).not.toHaveProperty('redisUrl');
+  });
+});