"""Headers every response carries once this is reachable from the internet.

Asserted on /api/health because it is the one route that needs no database and no
session — the headers are set in an after_request hook, so any response proves the
hook, and this suite has no Postgres.
"""
import pytest

from thoughtsync.app import create_app


@pytest.fixture
def app():
    return create_app()


async def test_content_security_policy_locks_scripts_to_self(app):
    resp = await app.test_client().get("/api/health")
    csp = resp.headers["Content-Security-Policy"]
    assert "script-src 'self'" in csp
    # The two that matter most if anything ever reflects user text into the page.
    assert "object-src 'none'" in csp
    assert "frame-ancestors 'none'" in csp
    # No blanket unsafe-inline for SCRIPT — style is the only place it's conceded.
    assert "script-src 'self' 'unsafe-inline'" not in csp


async def test_link_preview_images_are_still_allowed(app):
    resp = await app.test_client().get("/api/health")
    csp = resp.headers["Content-Security-Policy"]
    # A preview renders the og:image of an arbitrary host; both schemes, because a
    # LAN install is served over http.
    assert "img-src" in csp
    assert "https:" in csp
    assert "http:" in csp


async def test_sniffing_and_referrer_are_pinned(app):
    resp = await app.test_client().get("/api/health")
    assert resp.headers["X-Content-Type-Options"] == "nosniff"
    assert resp.headers["Referrer-Policy"] == "strict-origin-when-cross-origin"
    assert "camera=()" in resp.headers["Permissions-Policy"]


async def test_no_hsts_on_plain_http(app):
    # A plain-HTTP LAN install must not be told to refuse the only scheme it serves.
    resp = await app.test_client().get("/api/health")
    assert "Strict-Transport-Security" not in resp.headers


async def test_hsts_when_a_proxy_terminated_tls(app):
    resp = await app.test_client().get("/api/health", headers={"X-Forwarded-Proto": "https"})
    hsts = resp.headers["Strict-Transport-Security"]
    assert "max-age=" in hsts
    # Scoped to this host: neither of these commits domains the app doesn't own.
    assert "includeSubDomains" not in hsts
    assert "preload" not in hsts