| 1 | package calls |
| 2 | |
| 3 | import ( |
| 4 | "encoding/json" |
| 5 | "net/http" |
| 6 | "net/http/httptest" |
| 7 | "os" |
| 8 | "path/filepath" |
| 9 | "regexp" |
| 10 | "strings" |
| 11 | "testing" |
| 12 | ) |
| 13 | |
| 14 | func TestCreditsArePublicAndContainDependencyNotices(t *testing.T) { |
| 15 | fixture := newHomeRouterFixture(t) |
| 16 | app := fixture.handler |
| 17 | response := httptest.NewRecorder() |
| 18 | app.ServeHTTP(response, httptest.NewRequest(http.MethodGet, homeTestOrigin+"/help/open-source", nil)) |
| 19 | if response.Code != http.StatusOK || response.Header().Get("Location") != "" || len(response.Result().Cookies()) != 0 { |
| 20 | t.Fatal("credits required authentication", response.Code) |
| 21 | } |
| 22 | if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Referrer-Policy") != "strict-origin" { |
| 23 | // strict-origin, not no-referrer: the page shows the account menu, |
| 24 | // whose chained sign-out id.* admits by the Referer's origin (spec |
| 25 | // shared-chrome §9.5). It still sets no cookie (above). |
| 26 | t.Fatal("credits must send strict-origin", response.Header().Get("Referrer-Policy")) |
| 27 | } |
| 28 | for _, wanted := range []string{"No notice file is included in this release.", "estilo-credits", "Open source", "Lucide and Feather", "gorm.io/gorm", "gormlite/LICENSE", "/static/credits.css"} { |
| 29 | if !strings.Contains(response.Body.String(), wanted) { |
| 30 | t.Fatal("missing credit", wanted) |
| 31 | } |
| 32 | } |
| 33 | style := httptest.NewRecorder() |
| 34 | app.ServeHTTP(style, httptest.NewRequest(http.MethodGet, homeTestOrigin+"/static/credits.css", nil)) |
| 35 | if style.Code != http.StatusOK || !strings.HasPrefix(style.Header().Get("Content-Type"), "text/css") || !strings.Contains(style.Body.String(), "[estilo-credits]") { |
| 36 | t.Fatal("shared credit styles not served") |
| 37 | } |
| 38 | if output := os.Getenv("CALLS_CREDITS_EVIDENCE_DIR"); output != "" { |
| 39 | if err := os.MkdirAll(output, 0700); err != nil { |
| 40 | t.Fatal(err) |
| 41 | } |
| 42 | if err := os.WriteFile(filepath.Join(output, "page.html"), response.Body.Bytes(), 0600); err != nil { |
| 43 | t.Fatal(err) |
| 44 | } |
| 45 | for _, match := range regexp.MustCompile(`(?:href|src)="(/static/[^" ]+)"`).FindAllStringSubmatch(response.Body.String(), -1) { |
| 46 | asset := httptest.NewRecorder() |
| 47 | app.ServeHTTP(asset, httptest.NewRequest(http.MethodGet, homeTestOrigin+match[1], nil)) |
| 48 | if asset.Code != http.StatusOK { |
| 49 | t.Fatal("credits fixture asset unavailable", match[1]) |
| 50 | } |
| 51 | if err := os.WriteFile(filepath.Join(output, filepath.Base(match[1])), asset.Body.Bytes(), 0600); err != nil { |
| 52 | t.Fatal(err) |
| 53 | } |
| 54 | } |
| 55 | } |
| 56 | var inventory creditInventory |
| 57 | if err := json.Unmarshal(creditNotices, &inventory); err != nil { |
| 58 | t.Fatal(err) |
| 59 | } |
| 60 | if len(inventory.MissingNotices) != 1 || inventory.MissingNotices[0] != "github.com/keymaildev/signin" { |
| 61 | t.Fatal("new missing notice requires review") |
| 62 | } |
| 63 | } |
| 64 | |
amadan