모바일 fallback 변경. .env유출 가능성 차단

userfront/test/login_challenge_resolver_test.dart

@@ -8,7 +8,7 @@ void main() {
         widgetLoginChallenge: 'widget-challenge',
         uri: Uri.parse('/ko/login'),
         rawSearch: '?login_challenge=raw-search',
-        rawHref: 'https://sso-test.hmac.kr/ko/login?login_challenge=raw-href',
+        rawHref: 'https://sso.example.test/ko/login?login_challenge=raw-href',
       );
 
       expect(resolved.value, 'widget-challenge');
@@ -46,7 +46,7 @@ void main() {
         uri: Uri.parse('/ko/login'),
         rawSearch: '',
         rawHref:
-            'https://sso-test.hmac.kr/ko/login?a=1&login_challenge=raw-href-value#fragment',
+            'https://sso.example.test/ko/login?a=1&login_challenge=raw-href-value#fragment',
       );
 
       expect(resolved.value, 'raw-href-value');
@@ -59,7 +59,7 @@ void main() {
         widgetLoginChallenge: null,
         uri: Uri.parse('/ko/login'),
         rawSearch: '',
-        rawHref: 'https://sso-test.hmac.kr/ko/login?x=1',
+        rawHref: 'https://sso.example.test/ko/login?x=1',
       );
 
       expect(resolved.value, isNull);

userfront/test/oidc_redirect_guard_test.dart

@@ -5,12 +5,12 @@ void main() {
   group('oidc_redirect_guard', () {
     test('http/https 절대 URL만 허용', () {
       final ok = validateOidcRedirectTarget(
-        'https://sso-test.hmac.kr/oidc/oauth2/auth?client_id=devfront&login_verifier=abc&state=xyz&code_challenge=ccc&code_challenge_method=S256&response_type=code&scope=openid%20profile&redirect_uri=http%3A%2F%2Flocalhost%3A5174%2Fcallback',
+        'https://sso.example.test/oidc/oauth2/auth?client_id=devfront&login_verifier=abc&state=xyz&code_challenge=ccc&code_challenge_method=S256&response_type=code&scope=openid%20profile&redirect_uri=http%3A%2F%2Flocalhost%3A5174%2Fcallback',
       );
       expect(ok.isValid, isTrue);
       expect(ok.reason, 'ok');
       expect(ok.scheme, 'https');
-      expect(ok.host, 'sso-test.hmac.kr');
+      expect(ok.host, 'sso.example.test');
       expect(ok.path, '/oidc/oauth2/auth');
       expect(ok.isOidcAuthPath, isTrue);
       expect(ok.queryParamCount, 8);

userfront/test/password_login_flow_policy_test.dart

@@ -7,7 +7,7 @@ void main() {
       final action = decidePasswordLoginNextAction(
         hasLoginChallenge: true,
         redirectTo:
-            'https://sso-test.hmac.kr/oidc/oauth2/auth?login_verifier=a',
+            'https://sso.example.test/oidc/oauth2/auth?login_verifier=a',
         jwt: 'jwt-token',
       );
 

userfront/test/runtime_env_compile_time_test.dart

@@ -0,0 +1,43 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:userfront/core/services/runtime_env.dart';
+
+const _expectedBackendUrl = String.fromEnvironment('BACKEND_URL');
+const _expectedUserfrontUrl = String.fromEnvironment('USERFRONT_URL');
+
+void main() {
+  group('runtime env compile-time defines', () {
+    test('runtime fallback is empty outside a browser origin', () {
+      expect(runtimeOriginFallback(), isEmpty);
+    });
+
+    test('BACKEND_URL dart-define overrides runtime origin fallback when set', () {
+      if (_expectedBackendUrl.isEmpty) {
+        expect(runtimeBackendUrl(), runtimeOriginFallback());
+        return;
+      }
+
+      expect(runtimeBackendUrl(), sanitizedUrl(_expectedBackendUrl));
+    });
+
+    test(
+      'USERFRONT_URL dart-define overrides runtime origin fallback when set',
+      () {
+        if (_expectedUserfrontUrl.isEmpty) {
+          expect(runtimeUserfrontUrl(), runtimeOriginFallback());
+          return;
+        }
+
+        expect(runtimeUserfrontUrl(), sanitizedUrl(_expectedUserfrontUrl));
+      },
+    );
+
+    test('dart-define URLs are sanitized', () {
+      if (_expectedBackendUrl.isEmpty || _expectedUserfrontUrl.isEmpty) {
+        return;
+      }
+
+      expect(runtimeBackendUrl(), isNot(endsWith('/')));
+      expect(runtimeUserfrontUrl(), isNot(endsWith('/')));
+    });
+  });
+}