bvandeusenandClaude Opus 5.5
b74dc7c1fe
CI & Build / Python lint (push) Successful in 2s
CI & Build / Build now, or wait for Android? (push) Successful in 2s
Android / Build, or is the channel already serving this? (push) Successful in 3s
Desktop (Tauri) / Build, or is the channel already serving this? (push) Successful in 2s
Desktop (Tauri) / Web tests, clippy, Rust tests and rustfmt (push) Skipped
Desktop (Tauri) / Tauri desktop (Linux) (push) Skipped
Desktop (Tauri) / Windows installer (cross-compiled) (push) Skipped
Desktop (Tauri) / Update manifest (push) Skipped
CI & Build / Web typecheck and unit tests (push) Successful in 8s
CI & Build / Python tests (push) Successful in 13s
Android / Core and FFI clippy and tests (push) Successful in 25s
CI & Build / integration (push) Successful in 1m31s
CI & Build / Build & push image (push) Skipped
Android / Kotlin + Rust (APK) (push) Successful in 6m41s
Android / Build the server image (push) Successful in 1s
The tests' `app` fixture, the same two lines in eleven files, now lives once in
tests/conftest.py.
On Android each ViewModel carried a companion `factory` that only wrapped its
constructor in viewModelFactory { initializer { … } }. MainActivity now builds
each one with Compose's viewModel { … } builder, so the five factories and their
imports are gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
2.1 KiB
Python
50 lines
2.1 KiB
Python
"""Headers every response carries once this is reachable from the internet.
|
|
|
|
Asserted on /api/health because it is the one route that needs no database and no
|
|
session — the headers are set in an after_request hook, so any response proves the
|
|
hook, and this suite has no Postgres.
|
|
"""
|
|
|
|
|
|
async def test_content_security_policy_locks_scripts_to_self(app):
|
|
resp = await app.test_client().get("/api/health")
|
|
csp = resp.headers["Content-Security-Policy"]
|
|
assert "script-src 'self'" in csp
|
|
# The two that matter most if anything ever reflects user text into the page.
|
|
assert "object-src 'none'" in csp
|
|
assert "frame-ancestors 'none'" in csp
|
|
# No blanket unsafe-inline for SCRIPT — style is the only place it's conceded.
|
|
assert "script-src 'self' 'unsafe-inline'" not in csp
|
|
|
|
|
|
async def test_link_preview_images_are_still_allowed(app):
|
|
resp = await app.test_client().get("/api/health")
|
|
csp = resp.headers["Content-Security-Policy"]
|
|
# A preview renders the og:image of an arbitrary host; both schemes, because a
|
|
# LAN install is served over http.
|
|
assert "img-src" in csp
|
|
assert "https:" in csp
|
|
assert "http:" in csp
|
|
|
|
|
|
async def test_sniffing_and_referrer_are_pinned(app):
|
|
resp = await app.test_client().get("/api/health")
|
|
assert resp.headers["X-Content-Type-Options"] == "nosniff"
|
|
assert resp.headers["Referrer-Policy"] == "strict-origin-when-cross-origin"
|
|
assert "camera=()" in resp.headers["Permissions-Policy"]
|
|
|
|
|
|
async def test_no_hsts_on_plain_http(app):
|
|
# A plain-HTTP LAN install must not be told to refuse the only scheme it serves.
|
|
resp = await app.test_client().get("/api/health")
|
|
assert "Strict-Transport-Security" not in resp.headers
|
|
|
|
|
|
async def test_hsts_when_a_proxy_terminated_tls(app):
|
|
resp = await app.test_client().get("/api/health", headers={"X-Forwarded-Proto": "https"})
|
|
hsts = resp.headers["Strict-Transport-Security"]
|
|
assert "max-age=" in hsts
|
|
# Scoped to this host: neither of these commits domains the app doesn't own.
|
|
assert "includeSubDomains" not in hsts
|
|
assert "preload" not in hsts
|