import test from 'node:test';
import assert from 'node:assert/strict';
import { publishedPageCsp } from './mindspace-published-page-csp.mjs';
const PAGE_DATA_HTML = `
`;
test('publishedPageCsp raw mode allows same-origin external scripts for page-data-client.js', () => {
const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: true });
assert.match(csp, /script-src 'unsafe-inline' 'self'/);
});
test('publishedPageCsp raw mode keeps inline-only pages restricted', () => {
const html = '';
const csp = publishedPageCsp(html, { raw: true });
assert.match(csp, /script-src 'unsafe-inline'/);
assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/);
});
test('publishedPageCsp non-raw full html allows self when external scripts are present', () => {
const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: false });
assert.match(csp, /script-src 'self'/);
});