import assert from 'node:assert/strict';
import test from 'node:test';
import {
appendPublicAssetTokens,
normalizePublicAssetReferences,
preparePublicHtmlAssetDelivery,
publicAssetToken,
stripPublicHtmlBaseTag,
verifyPublicAssetToken,
} from './mindspace-public-asset-token.mjs';
const SECRET = 'internal-agent-secret-for-tests';
test('public asset token round-trips for the matching asset id', () => {
const token = publicAssetToken('asset-1', SECRET);
assert.equal(verifyPublicAssetToken('asset-1', token, SECRET), true);
assert.equal(verifyPublicAssetToken('asset-2', token, SECRET), false);
});
test('appendPublicAssetTokens signs public asset download urls without clobbering existing query params', () => {
const html = [
'
',
'
',
].join('');
const signed = appendPublicAssetTokens(html, SECRET);
assert.match(
signed,
/asset-1\/download\?inline=1&v=2&public_token=[A-Za-z0-9_-]+/,
);
assert.match(
signed,
/asset-2\/download\?inline=1&v=3&public_token=[A-Za-z0-9_-]+/,
);
});
test('appendPublicAssetTokens preserves existing public tokens', () => {
const html = '
';
assert.equal(appendPublicAssetTokens(html, SECRET), html);
});
test('normalizePublicAssetReferences rewrites absolute asset urls to same-origin paths', () => {
const html = [
'
',
'
',
'',
].join('');
const normalized = normalizePublicAssetReferences(html);
assert.match(normalized, /src="\/api\/mindspace\/v1\/assets\/asset-1\/download\?inline=1"/);
assert.match(normalized, /src="\/api\/mindspace\/v1\/assets\/asset-2\/download\?inline=1&v=3"/);
assert.match(
normalized,
/content="\/api\/mindspace\/v1\/assets\/asset-3\/download\?inline=1"/,
);
});
test('stripPublicHtmlBaseTag removes base tags blocked by public page CSP', () => {
const html = 'demo';
assert.equal(stripPublicHtmlBaseTag(html), 'demo');
});
test('preparePublicHtmlAssetDelivery normalizes asset urls before signing', () => {
const html = '';
const prepared = preparePublicHtmlAssetDelivery(html, SECRET);
assert.doesNotMatch(prepared, /