| 1 | package calendar |
| 2 | |
| 3 | import ( |
| 4 | "net/http/httptest" |
| 5 | "testing" |
| 6 | ) |
| 7 | |
| 8 | // TestHomeCSPPreservesPinnedFrameworkDirectives: with Home on, connect's |
| 9 | // middleware replaces the policy with connect.FormPolicy. Through the |
| 10 | // production stack (App.ServeOptions), every directive must still be |
| 11 | // rastrillo's default but two: form-action also names the issuer, and |
| 12 | // style-src is 'self' 'unsafe-inline', which the day and week grids' |
| 13 | // chip positions need (ContentSecurityPolicy says why). |
| 14 | func TestHomeCSPPreservesPinnedFrameworkDirectives(t *testing.T) { |
| 15 | f := newHomeRouterFixture(t) |
| 16 | wrapped := productionHandler(t, f.app) |
| 17 | for _, path := range []string{"/signin/local", "/auth/start", "/account/home", "/signed-out"} { |
| 18 | rec := httptest.NewRecorder() |
| 19 | wrapped.ServeHTTP(rec, httptest.NewRequest("GET", homeTestOrigin+path, nil)) |
| 20 | got := rec.Header().Values("Content-Security-Policy") |
| 21 | if len(got) != 1 { |
| 22 | t.Fatalf("%s: %d policies, want one: %q", path, len(got), got) |
| 23 | } |
| 24 | samePolicyBut(t, path, got[0], map[string]string{ |
| 25 | "form-action": "'self' " + homeTestIssuer, |
| 26 | "style-src": "'self' 'unsafe-inline'", |
| 27 | }) |
| 28 | } |
| 29 | } |
| 30 | |
amadan