import test from 'node:test';
import assert from 'node:assert/strict';
import { publishedPageCsp } from './mindspace-published-page-csp.mjs';
const PAGE_DATA_HTML = `
`;
const INLINE_ONCLICK_HTML = `
`;
test('publishedPageCsp default full html uses hybrid inline policy with self scripts', () => {
const csp = publishedPageCsp(PAGE_DATA_HTML);
assert.match(csp, /script-src 'unsafe-inline' 'self'/);
assert.match(csp, /script-src-attr 'unsafe-inline'/);
assert.doesNotMatch(csp, /'sha256-/);
});
test('publishedPageCsp default full html allows dynamic onclick handlers', () => {
const csp = publishedPageCsp(INLINE_ONCLICK_HTML);
assert.match(csp, /script-src 'unsafe-inline'/);
assert.match(csp, /script-src-attr 'unsafe-inline'/);
});
test('publishedPageCsp raw mode matches default hybrid policy for full html', () => {
const rawCsp = publishedPageCsp(PAGE_DATA_HTML, { raw: true });
const defaultCsp = publishedPageCsp(PAGE_DATA_HTML, { raw: false });
assert.equal(rawCsp, defaultCsp);
});
test('publishedPageCsp wechatShare mode allows self and wx bridge scripts', () => {
const csp = publishedPageCsp(PAGE_DATA_HTML, { wechatShare: true });
assert.match(csp, /script-src 'unsafe-inline' 'self' https:\/\/res\.wx\.qq\.com/);
assert.match(csp, /script-src-attr 'unsafe-inline'/);
});
test('publishedPageCsp wechatShare mode keeps inline-only pages without self', () => {
const html = '';
const csp = publishedPageCsp(html, { wechatShare: true });
assert.match(csp, /script-src 'unsafe-inline' https:\/\/res\.wx\.qq\.com/);
assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/);
});