| 1 | package calendar |
| 2 | |
| 3 | import ( |
| 4 | "encoding/json" |
| 5 | "net/http" |
| 6 | "net/http/httptest" |
| 7 | "os" |
| 8 | "path/filepath" |
| 9 | "regexp" |
| 10 | "strings" |
| 11 | "testing" |
| 12 | ) |
| 13 | |
| 14 | func TestCreditsArePublicAndContainDependencyNotices(t *testing.T) { |
| 15 | app := NewForTest(t, t.TempDir()) |
| 16 | response := httptest.NewRecorder() |
| 17 | app.Handler().ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/help/open-source", nil)) |
| 18 | if response.Code != http.StatusOK || response.Header().Get("Location") != "" || len(response.Result().Cookies()) != 0 { |
| 19 | t.Fatal("credits required authentication", response.Code) |
| 20 | } |
| 21 | if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Referrer-Policy") != "strict-origin" { |
| 22 | // strict-origin, not no-referrer (shared-chrome spec §9.5): the page |
| 23 | // shows the account menu, and Home's sign-out chain refuses a POST |
| 24 | // with no Origin/Referer. strict-origin still never sends a path. |
| 25 | t.Fatal("credits must send Referrer-Policy: strict-origin, got", response.Header().Get("Referrer-Policy")) |
| 26 | } |
| 27 | for _, wanted := range []string{"No notice file is included in this release.", "estilo-credits", "Open source", "Lucide and Feather", "gorm.io/gorm", "gormlite/LICENSE", "/static/credits.css"} { |
| 28 | if !strings.Contains(response.Body.String(), wanted) { |
| 29 | t.Fatal("missing credit", wanted) |
| 30 | } |
| 31 | } |
| 32 | style := httptest.NewRecorder() |
| 33 | app.Handler().ServeHTTP(style, httptest.NewRequest(http.MethodGet, "/static/credits.css", nil)) |
| 34 | if style.Code != http.StatusOK || !strings.HasPrefix(style.Header().Get("Content-Type"), "text/css") || !strings.Contains(style.Body.String(), "[estilo-credits]") { |
| 35 | t.Fatal("shared credit styles not served") |
| 36 | } |
| 37 | if output := os.Getenv("CALENDAR_CREDITS_EVIDENCE_DIR"); output != "" { |
| 38 | if err := os.MkdirAll(output, 0700); err != nil { |
| 39 | t.Fatal(err) |
| 40 | } |
| 41 | if err := os.WriteFile(filepath.Join(output, "page.html"), response.Body.Bytes(), 0600); err != nil { |
| 42 | t.Fatal(err) |
| 43 | } |
| 44 | for _, match := range regexp.MustCompile(`(?:href|src)="(/static/[^" ]+)"`).FindAllStringSubmatch(response.Body.String(), -1) { |
| 45 | asset := httptest.NewRecorder() |
| 46 | app.Handler().ServeHTTP(asset, httptest.NewRequest(http.MethodGet, match[1], nil)) |
| 47 | if asset.Code != http.StatusOK { |
| 48 | t.Fatal("credits fixture asset unavailable", match[1]) |
| 49 | } |
| 50 | if err := os.WriteFile(filepath.Join(output, filepath.Base(match[1])), asset.Body.Bytes(), 0600); err != nil { |
| 51 | t.Fatal(err) |
| 52 | } |
| 53 | } |
| 54 | } |
| 55 | var inventory creditInventory |
| 56 | if err := json.Unmarshal(creditNotices, &inventory); err != nil { |
| 57 | t.Fatal(err) |
| 58 | } |
| 59 | if len(inventory.MissingNotices) != 1 || inventory.MissingNotices[0] != "github.com/keymaildev/signin" { |
| 60 | t.Fatal("new missing notice requires review") |
| 61 | } |
| 62 | } |
| 63 | |
amadan