Claudio Ortolina
ca01e94d47
Add smoke tests for bulk cron workers, CSP browser header, and on_mount hooks (GetTimezone/StaticAssets). 9 tests across 4 files, all passing alongside 135 existing related tests.
35 lines
1.0 KiB
Elixir
35 lines
1.0 KiB
Elixir
defmodule MusicLibraryWeb.BrowserPipelineTest do
|
|
use MusicLibraryWeb.ConnCase
|
|
|
|
describe "Content-Security-Policy header" do
|
|
@describetag :logged_out
|
|
|
|
test "includes project-specific directives on HTML responses", %{conn: conn} do
|
|
conn = get(conn, ~p"/health")
|
|
|
|
assert [csp] = get_resp_header(conn, "content-security-policy")
|
|
|
|
# Baseline
|
|
assert csp =~ "default-src 'self'"
|
|
|
|
# App-specific image origins (cover art, Brave search)
|
|
assert csp =~ "img-src 'self' data: blob:"
|
|
assert csp =~ "https://lastfm.freetls.fastly.net"
|
|
assert csp =~ "https://imgs.search.brave.com"
|
|
assert csp =~ "https://coverartarchive.org"
|
|
|
|
# Worker support (barcode-detector WASM)
|
|
assert csp =~ "worker-src 'self' blob:"
|
|
|
|
# Connect for CDN (barcode-detector JS)
|
|
assert csp =~ "connect-src 'self' https://fastly.jsdelivr.net"
|
|
|
|
# No framing from other origins
|
|
assert csp =~ "frame-ancestors 'self'"
|
|
|
|
# Base URI locked to same origin
|
|
assert csp =~ "base-uri 'self'"
|
|
end
|
|
end
|
|
end
|