tkmind_go/ui/h5/mindspace-content-scan.test.mjs

import assert from 'node:assert/strict';
import test from 'node:test';
import { redactContent, scanContent } from './mindspace-content-scan.mjs';

test('scanContent warns on phone numbers', () => {
  const result = scanContent('联系电话 13800138000');
  assert.equal(result.status, 'warned');
  assert.equal(result.allowed, true);
  assert.equal(result.findings[0].type, 'phone');
});

test('scanContent ignores trusted google font hosts', () => {
  const result = scanContent(
    "@import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC&display=swap');",
  );
  assert.equal(result.findings.length, 0);
  assert.equal(result.allowed, true);
});

test('scanContent blocks id cards', () => {
  const result = scanContent('身份证 11010119900307888X');
  assert.equal(result.status, 'blocked');
  assert.equal(result.allowed, false);
});

test('scanContent blocks html active content and private references', () => {
  const result = scanContent(
    '<script>alert(1)</script><a href="javascript:alert(1)">x</a><img src="/api/mindspace/v1/assets/abc/preview">',
    { format: 'html' },
  );
  assert.equal(result.allowed, false);
  assert.deepEqual(
    result.findings.map((finding) => finding.type),
    ['html_script', 'html_javascript_url', 'private_resource_reference'],
  );
});

test('redactContent masks secrets and strips unsafe html', () => {
  const result = redactContent(
    '手机号 13800138000\n邮箱 john@example.com\n<script>alert(1)</script>\nkey=sk_test_1234567890abcdef',
    { format: 'html' },
  );
  assert.equal(result.changed, true);
  assert.doesNotMatch(result.content, /13800138000/);
  assert.doesNotMatch(result.content, /john@example.com/);
  assert.doesNotMatch(result.content, /<script>/);
  assert.doesNotMatch(result.content, /sk_test_1234567890abcdef/);
});