|
| 1 | +import { describe, expect, it } from 'vitest' |
| 2 | + |
| 3 | +/** |
| 4 | + * Tests for security.strict mode config resolution. |
| 5 | + * Mirrors the logic in module.ts for resolving security defaults. |
| 6 | + */ |
| 7 | +function resolveSecurityConfig(config?: { |
| 8 | + strict?: boolean |
| 9 | + secret?: string |
| 10 | + maxQueryParamSize?: number | null |
| 11 | + restrictRuntimeImagesToOrigin?: boolean | string[] |
| 12 | +}) { |
| 13 | + return { |
| 14 | + strict: config?.strict ?? false, |
| 15 | + maxDimension: 2048, |
| 16 | + maxDpr: 2, |
| 17 | + renderTimeout: 15_000, |
| 18 | + maxQueryParamSize: config?.maxQueryParamSize ?? (config?.strict ? 2048 : null), |
| 19 | + restrictRuntimeImagesToOrigin: config?.restrictRuntimeImagesToOrigin === true || (config?.strict && config?.restrictRuntimeImagesToOrigin == null) |
| 20 | + ? [] |
| 21 | + : (config?.restrictRuntimeImagesToOrigin || false), |
| 22 | + secret: config?.secret || '', |
| 23 | + } |
| 24 | +} |
| 25 | + |
| 26 | +describe('security.strict mode defaults', () => { |
| 27 | + it('defaults to non-strict with no limits', () => { |
| 28 | + const result = resolveSecurityConfig() |
| 29 | + expect(result.strict).toBe(false) |
| 30 | + expect(result.maxQueryParamSize).toBeNull() |
| 31 | + expect(result.restrictRuntimeImagesToOrigin).toBe(false) |
| 32 | + }) |
| 33 | + |
| 34 | + it('strict mode sets maxQueryParamSize to 2048', () => { |
| 35 | + const result = resolveSecurityConfig({ strict: true, secret: 'test' }) |
| 36 | + expect(result.maxQueryParamSize).toBe(2048) |
| 37 | + }) |
| 38 | + |
| 39 | + it('strict mode enables restrictRuntimeImagesToOrigin', () => { |
| 40 | + const result = resolveSecurityConfig({ strict: true, secret: 'test' }) |
| 41 | + expect(result.restrictRuntimeImagesToOrigin).toEqual([]) |
| 42 | + }) |
| 43 | + |
| 44 | + it('explicit maxQueryParamSize overrides strict default', () => { |
| 45 | + const result = resolveSecurityConfig({ strict: true, secret: 'test', maxQueryParamSize: 4096 }) |
| 46 | + expect(result.maxQueryParamSize).toBe(4096) |
| 47 | + }) |
| 48 | + |
| 49 | + it('explicit restrictRuntimeImagesToOrigin array overrides strict default', () => { |
| 50 | + const result = resolveSecurityConfig({ |
| 51 | + strict: true, |
| 52 | + secret: 'test', |
| 53 | + restrictRuntimeImagesToOrigin: ['https://cdn.example.com'], |
| 54 | + }) |
| 55 | + expect(result.restrictRuntimeImagesToOrigin).toEqual(['https://cdn.example.com']) |
| 56 | + }) |
| 57 | + |
| 58 | + it('explicit restrictRuntimeImagesToOrigin false overrides strict default', () => { |
| 59 | + const result = resolveSecurityConfig({ |
| 60 | + strict: true, |
| 61 | + secret: 'test', |
| 62 | + restrictRuntimeImagesToOrigin: false, |
| 63 | + }) |
| 64 | + expect(result.restrictRuntimeImagesToOrigin).toBe(false) |
| 65 | + }) |
| 66 | + |
| 67 | + it('strict mode requires secret (validated at module setup)', () => { |
| 68 | + // Module setup throws when strict is true and secret is missing. |
| 69 | + // This test documents the contract; the actual throw is in module.ts setup(). |
| 70 | + const config = { strict: true } |
| 71 | + expect(config.strict && !config.secret).toBe(true) |
| 72 | + }) |
| 73 | +}) |
0 commit comments