@carlonicora/nextjs-jsonapi 3.28.2 → 4.0.0

package/src/features/analytics/components/server/AnalyticsJourneyPage.tsx

@@ -15,7 +15,11 @@ type Props = {
   deniedRedirect?: string;
 };
 
-/** Server page for one session's journey: role gate, then the client container. */
+/**
+ * Server page for one session's journey: role gate, then the client container.
+ *
+ * Reads the session: render inside a `<Suspense>` boundary (Cache Components).
+ */
 export async function AnalyticsJourneyPage({ adminRoleId, sessionId, pageUrl, deniedRedirect = "/" }: Props) {
   if (!(await ServerSession.hasRole(adminRoleId))) {
     redirect(deniedRedirect);

package/src/features/notification/contexts/NotificationContext.tsx

@@ -63,8 +63,11 @@ export const NotificationContextProvider = ({ children }: NotificationContextPro
   // Access current user for initial load check
   const { currentUser } = useCurrentUserContext();
 
-  // Calculate shouldRefresh (5 minute cache)
-  const shouldRefresh = Date.now() - lastLoaded > 5 * 60 * 1000;
+  // Calculate shouldRefresh (5 minute cache). Never loaded short-circuits before
+  // Date.now(): under Cache Components a clock read during render marks the
+  // enclosing boundary dynamic, which kept a layout's whole app frame out of the
+  // prerendered shell. Same result: Date.now() - 0 always exceeds 5 minutes.
+  const shouldRefresh = lastLoaded === 0 || Date.now() - lastLoaded > 5 * 60 * 1000;
 
   const addNotification = useCallback((notification: NotificationInterface) => {
     setNotifications((prev) => {

package/src/features/notification/contexts/__tests__/NotificationContext.spec.tsx

@@ -126,3 +126,25 @@ describe("NotificationContextProvider failed load", () => {
     expect(result.current.error).toBe("500:");
   });
 });
+
+describe("NotificationContextProvider first render", () => {
+  beforeAll(() => {
+    configureI18n({
+      useRouter: () => stubRouter,
+      useTranslations: () => (key: string) => key,
+      usePathname: () => "/",
+      Link: (({ children }: { children: React.ReactNode }) => children) as any,
+    });
+  });
+
+  // Under Cache Components a clock read during render marks the enclosing
+  // boundary dynamic, which kept a layout's whole app frame out of the shell.
+  it("does not read the clock before anything has loaded, and still wants a refresh", () => {
+    userMock.currentUser = undefined;
+    const now = vi.spyOn(Date, "now");
+    const { result } = renderHook(() => useNotificationContext(), { wrapper });
+    expect(now).not.toHaveBeenCalled();
+    expect(result.current.shouldRefresh).toBe(true);
+    now.mockRestore();
+  });
+});

package/src/features/user/contexts/CurrentUserContext.tsx

@@ -3,7 +3,6 @@
 import { getCookie } from "cookies-next";
 import { useAtom } from "jotai";
 import { atomWithStorage } from "jotai/utils";
-import { usePathname } from "next/navigation";
 import React, { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { useSocketContext } from "../../../contexts/SocketContext";
 import { Modules, rehydrate } from "../../../core";
@@ -43,11 +42,12 @@ const userAtom = atomWithStorage(CURRENT_USER_STORAGE_KEY, null);
 const CurrentUserContext = createContext<CurrentUserContextType | undefined>(undefined);
 
 export const CurrentUserProvider = ({ children }: { children: React.ReactNode }) => {
-  const path = usePathname();
-
   const [dehydratedUser, setDehydratedUser] = useAtom(userAtom);
 
-  const matchUrlToModule = (_params?: { path: string }): ModuleWithPermissions | undefined => {
+  const matchUrlToModule = (params?: { path: string }): ModuleWithPermissions | undefined => {
+    const path = params?.path?.toLowerCase();
+    if (!path) return undefined;
+
     const moduleKeys = Object.getOwnPropertyNames(Modules).filter(
       (key) => key !== "prototype" && key !== "_factory" && key !== "length" && key !== "name",
     );
@@ -59,7 +59,9 @@ export const CurrentUserProvider = ({ children }: { children: React.ReactNode })
 
       const selectedModule = descriptor.get.call(Modules);
 
-      return path.toLowerCase().startsWith(selectedModule.pageUrl?.toLowerCase());
+      if (!selectedModule?.pageUrl) return false;
+
+      return path.startsWith(selectedModule.pageUrl.toLowerCase());
     });
 
     if (!matchedModuleKey) return undefined;

package/src/features/user/contexts/__tests__/CurrentUserContext.spec.tsx

@@ -5,8 +5,17 @@ vi.mock("cookies-next", () => ({
   getCookie: vi.fn(() => undefined),
 }));
 
+// vitest.setup.ts mocks next/navigation globally; override usePathname so it
+// throws: the provider must not depend on the current pathname at all
+// (hasPermissionToPath checks the path it is given).
 vi.mock("next/navigation", () => ({
-  usePathname: () => "/",
+  usePathname: () => {
+    throw new Error("CurrentUserProvider must not call usePathname");
+  },
+}));
+
+const permissionsMock = vi.hoisted(() => ({
+  checkPermissions: vi.fn((_params: { module: { name: string } }) => true),
 }));
 
 const socketMock = vi.hoisted(() => {
@@ -49,8 +58,18 @@ vi.mock("../../../../core", () => {
       return this._availableExtraCredits ?? 0;
     }
   }
+  const Modules: Record<string, unknown> = { User: { name: "users" } };
+  // The real Modules registry exposes each module through a getter.
+  Object.defineProperty(Modules, "Roll", {
+    get: () => ({ name: "rolls", pageUrl: "/rolls" }),
+    enumerable: true,
+  });
+  Object.defineProperty(Modules, "Person", {
+    get: () => ({ name: "persons", pageUrl: "/persons" }),
+    enumerable: true,
+  });
   return {
-    Modules: { User: { name: "users" } },
+    Modules,
     rehydrate: (_module: unknown, data: any) => ({
       ...data,
       company: data.company ? Object.assign(new FakeCompany(), data.company) : null,
@@ -60,7 +79,7 @@ vi.mock("../../../../core", () => {
 
 vi.mock("../../../../permissions", () => ({
   Action: { Read: "read", Write: "write", Create: "create", Update: "update", Delete: "delete" },
-  checkPermissions: () => true,
+  checkPermissions: permissionsMock.checkPermissions,
 }));
 
 vi.mock("../../../../roles", () => ({
@@ -322,3 +341,44 @@ describe("CurrentUserProvider token updates", () => {
     expect(UserService.findFullUser).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("CurrentUserProvider path permissions", () => {
+  let ctx: ReturnType<typeof useCurrentUserContext> | undefined;
+  function Capture() {
+    ctx = useCurrentUserContext();
+    return null;
+  }
+
+  beforeEach(() => {
+    localStorage.clear();
+    vi.clearAllMocks();
+    ctx = undefined;
+    permissionsMock.checkPermissions.mockImplementation(() => true);
+  });
+
+  it("hasPermissionToPath checks the module of the given path, not the current page", async () => {
+    localStorage.setItem("user", JSON.stringify({ id: "user-1", roles: [], company: null, modules: [] }));
+    permissionsMock.checkPermissions.mockImplementation(({ module }) => module.name === "rolls");
+
+    render(
+      <CurrentUserProvider>
+        <Capture />
+      </CurrentUserProvider>,
+    );
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    expect(ctx!.hasPermissionToPath("/persons")).toBe(false);
+    expect(ctx!.hasPermissionToPath("/rolls")).toBe(true);
+  });
+
+  it("matchUrlToModule returns undefined without a path", () => {
+    render(
+      <CurrentUserProvider>
+        <Capture />
+      </CurrentUserProvider>,
+    );
+
+    expect(ctx!.matchUrlToModule()).toBeUndefined();
+    expect(ctx!.matchUrlToModule({ path: "/rolls/123" })).toEqual({ name: "rolls", pageUrl: "/rolls" });
+  });
+});

package/src/hooks/__tests__/useSocket.render.test.ts

@@ -0,0 +1,22 @@
+import { renderHook } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("socket.io-client", () => ({ default: vi.fn() }));
+
+import { useSocket } from "../useSocket";
+
+describe("useSocket render", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  // Under Cache Components a Math.random() during render marks the enclosing
+  // boundary as dynamic, so a layout's SocketProvider would keep the whole app
+  // frame out of the prerendered shell.
+  it("never calls Math.random while rendering", () => {
+    const random = vi.spyOn(Math, "random");
+    const { rerender } = renderHook(() => useSocket({ token: "" }));
+    rerender();
+    expect(random).not.toHaveBeenCalled();
+  });
+});

package/src/hooks/useSocket.ts

@@ -34,7 +34,6 @@ interface UseSocketReturn {
 export function useSocket({ token }: UseSocketOptions): UseSocketReturn {
   const _errorCount = useRef(0);
   const shouldConnect = useRef(true);
-  const _hookInstanceId = useRef(Math.random().toString(36).substring(2, 11));
 
   const [socket, setSocket] = useState<Socket | null>(null);
   const [isConnected, setIsConnected] = useState<boolean>(false);

package/src/i18n/__tests__/config.test.ts

@@ -0,0 +1,27 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { configureI18n, getI18nServerLocale, type I18nConfig } from "../config";
+
+function config(getLocale: I18nConfig["getLocale"]): I18nConfig {
+  return {
+    useRouter: vi.fn(),
+    useTranslations: vi.fn(),
+    Link: vi.fn() as unknown as I18nConfig["Link"],
+    usePathname: vi.fn(),
+    getLocale,
+  };
+}
+
+describe("getI18nServerLocale", () => {
+  afterEach(() => {
+    configureI18n(null as unknown as I18nConfig);
+  });
+
+  it("returns the locale from the configured getLocale", async () => {
+    configureI18n(config(async () => "it"));
+    await expect(getI18nServerLocale()).resolves.toBe("it");
+  });
+
+  it("throws when i18n is not configured", async () => {
+    await expect(getI18nServerLocale()).rejects.toThrow(/configureI18n/);
+  });
+});

package/src/i18n/config.ts

@@ -13,6 +13,7 @@ export interface I18nRouter {
 export type UseRouterHook = () => I18nRouter;
 export type UseTranslationsHook = (namespace?: string) => (key: string, values?: Record<string, any>) => string;
 export type UseLocaleHook = () => string;
+export type GetLocaleFunction = () => Promise<string>;
 
 export type UseDateFnsLocaleHook = () => any; // date-fns Locale type
 export type LinkComponent = ComponentType<{ href: string; children: React.ReactNode; [key: string]: any }>;
@@ -24,6 +25,14 @@ export interface I18nConfig {
   useDateFnsLocale?: UseDateFnsLocaleHook;
   Link: LinkComponent;
   usePathname: () => string;
+  /**
+   * Server-side locale for API requests (pass next-intl's `getLocale` from `next-intl/server`).
+   *
+   * The library never imports next-intl itself: instrumentation loads the library, and
+   * next-intl's `getLocale` pulls in the app's `i18n/request.ts`, which reads
+   * `next/root-params` — a module only allowed inside the app directory.
+   */
+  getLocale: GetLocaleFunction;
 }
 
 // Private storage
@@ -65,6 +74,14 @@ export function useI18nLocale(): string {
   return "en";
 }
 
+/** The server-side locale from the app's `getLocale`. Throws when `configureI18n` has not run. */
+export async function getI18nServerLocale(): Promise<string> {
+  if (!_config?.getLocale) {
+    throw new Error("i18n not configured. Call configureI18n() with getLocale at app startup.");
+  }
+  return _config.getLocale();
+}
+
 export function useI18nDateFnsLocale(): any {
   if (_config?.useDateFnsLocale) {
     return _config.useDateFnsLocale();

package/src/i18n/index.ts

@@ -5,6 +5,7 @@ export {
   useI18nLocale,
   useI18nDateFnsLocale,
   getI18nLink,
+  getI18nServerLocale,
 } from "./config";
 
 export type {
@@ -13,6 +14,7 @@ export type {
   UseRouterHook,
   UseTranslationsHook,
   UseLocaleHook,
+  GetLocaleFunction,
   UseDateFnsLocaleHook,
   LinkComponent,
 } from "./config";

package/src/next-config/__tests__/createNextConfig.test.ts

@@ -0,0 +1,268 @@
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// The helper reads process.env when it builds the config, exactly as a real
+// next.config.js does, so the env is fixed before the helper is imported.
+const FIXED_ENV = vi.hoisted(() => {
+  const env = {
+    NEXT_PUBLIC_API_URL: "https://api.test",
+    NEXT_PUBLIC_ADDRESS: "https://app.test",
+    IMAGE_SOURCES: "https://img.test",
+    APP_URL: "https://app.test",
+  };
+  for (const key of [
+    "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
+    "NEXT_PUBLIC_GOOGLE_MAPS_API_KEY",
+    "NEXT_PUBLIC_CORPUS_URL",
+    "NEXT_PUBLIC_GTM_ID",
+    "E2E_BUILD",
+  ])
+    delete process.env[key];
+  Object.assign(process.env, env);
+  return env;
+});
+
+import { buildCsp, createNextConfig, type NjaNextConfigOptions } from "../index";
+
+type Pass = "production" | "e2e" | "development";
+const PASSES: Record<Pass, Record<string, string | undefined>> = {
+  production: { NODE_ENV: "production", E2E_BUILD: undefined },
+  e2e: { NODE_ENV: "production", E2E_BUILD: "true" },
+  development: { NODE_ENV: "development", E2E_BUILD: undefined },
+};
+
+type Json = unknown;
+
+/** Turns a resolved config into a comparable tree: headers keyed by source and
+ * header name, CSP parsed into directive -> sorted, de-duplicated sources
+ * (source order and whitespace carry no meaning in CSP), functions as markers. */
+function normalise(config: Record<string, unknown>): Record<string, Json> {
+  const out: Record<string, Json> = JSON.parse(
+    JSON.stringify(config, (key, v) => (typeof v === "function" ? `[Function ${v.name || key}]` : v)),
+  );
+  if (Array.isArray(out.headers)) {
+    const headers: Record<string, Record<string, Json>> = {};
+    for (const entry of out.headers as { source: string; headers: { key: string; value: string }[] }[]) {
+      const byKey: Record<string, Json> = {};
+      for (const { key, value } of entry.headers) {
+        byKey[key] = key === "Content-Security-Policy" ? parseCsp(value) : value;
+      }
+      headers[entry.source] = byKey;
+    }
+    out.headers = headers;
+  }
+  return out;
+}
+
+function parseCsp(value: string): Record<string, string[]> {
+  const directives: Record<string, string[]> = {};
+  for (const part of value.split(";")) {
+    const [name, ...sources] = part.trim().split(/\s+/).filter(Boolean);
+    if (name) directives[name] = [...new Set(sources)].sort();
+  }
+  return directives;
+}
+
+function getPath(tree: Json, dotPath: string): Json {
+  return dotPath.split(".").reduce<Json>((node, key) => (node as Record<string, Json> | undefined)?.[key], tree);
+}
+
+function stubPass(pass: Pass) {
+  for (const [key, value] of Object.entries(PASSES[pass])) vi.stubEnv(key, value);
+}
+
+async function resolveHelper(options: NjaNextConfigOptions, pass: Pass): Promise<Record<string, Json>> {
+  stubPass(pass);
+  const config = createNextConfig(options) as Record<string, unknown>;
+  const resolved: Record<string, unknown> = { ...config };
+  if (typeof config.headers === "function") resolved.headers = await (config.headers as () => Promise<unknown>)();
+  if (typeof config.rewrites === "function") resolved.rewrites = await (config.rewrites as () => Promise<unknown>)();
+  return normalise(resolved);
+}
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe("createNextConfig: behaviour", () => {
+  const base: NjaNextConfigOptions = { devOrigins: ["example.test"] };
+
+  it("never requires a non-builtin module", () => {
+    const dir = path.resolve(__dirname, "..");
+    const files = readdirSync(dir).filter((f) => f.endsWith(".ts"));
+    expect(files.sort()).toEqual(["csp.ts", "headers.ts", "index.ts"]);
+
+    const offenders: string[] = [];
+    for (const file of files) {
+      const source = readFileSync(path.join(dir, file), "utf8");
+      const statements = source.match(/^\s*(?:import|export)\b[^;]*?\bfrom\s*["'][^"']+["']/gm) ?? [];
+      for (const statement of statements) {
+        const specifier = statement.match(/["']([^"']+)["']$/)![1];
+        const typeOnly = /^\s*(?:import|export)\s+type\b/.test(statement);
+        if (specifier.startsWith("./") || specifier.startsWith("node:")) continue;
+        if (specifier === "next" && typeOnly) continue;
+        offenders.push(`${file}: ${statement.trim()}`);
+      }
+      for (const dynamic of source.match(/\b(?:require|import)\s*\(\s*["'][^"']+["']\s*\)/g) ?? []) {
+        if (!/["'](?:\.\/|node:)/.test(dynamic)) offenders.push(`${file}: ${dynamic}`);
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  it("sets the Next 16.4 flags every consumer gets, and nothing from the old config", () => {
+    const config = createNextConfig(base) as Record<string, unknown>;
+    expect(config.cacheComponents).toBe(true);
+    expect(config.partialPrefetching).toBe(true);
+    expect(config.poweredByHeader).toBe(false);
+    expect(config.reactStrictMode).toBe(false);
+    expect(config.reactCompiler).toBe(false);
+    expect(config.turbopack).toEqual({ resolveAlias: { yjs: "./node_modules/yjs" } });
+    expect(config.webpack).toBeUndefined();
+    expect(config.experimental).toEqual(
+      expect.objectContaining({
+        authInterrupts: true,
+        turbopackGc: true,
+        turbopackLazyDynamicImports: true,
+        serverActions: { bodySizeLimit: "5mb" },
+      }),
+    );
+    expect(config.experimental).not.toHaveProperty("useCache");
+  });
+
+  it("derives pageExtensions, serverExternalPackages and images from the options and env", () => {
+    const plain = createNextConfig(base) as Record<string, unknown>;
+    expect(plain.pageExtensions).toEqual(["ts", "tsx"]);
+    expect(plain.serverExternalPackages).toBeUndefined();
+    expect(plain.allowedDevOrigins).toEqual(["example.test"]);
+    expect(plain.images).toEqual({
+      minimumCacheTTL: 60,
+      remotePatterns: [{ protocol: "https", hostname: "img.test" }],
+      dangerouslyAllowLocalIP: true,
+    });
+
+    const full = createNextConfig({ ...base, mdx: true, serwist: true, imageMinimumCacheTTL: 86400 }) as Record<
+      string,
+      unknown
+    >;
+    expect(full.pageExtensions).toEqual(["ts", "tsx", "mdx"]);
+    expect(full.serverExternalPackages).toEqual(["esbuild", "esbuild-wasm"]);
+    expect((full.images as { minimumCacheTTL: number }).minimumCacheTTL).toBe(86400);
+  });
+
+  it("omits HSTS and upgrade-insecure-requests when E2E_BUILD=true", async () => {
+    const e2e = await resolveHelper(base, "e2e");
+    const e2eHeaders = getPath(e2e, "headers./:path*") as Record<string, Json>;
+    expect(e2eHeaders["Strict-Transport-Security"]).toBeUndefined();
+    expect(e2eHeaders["Content-Security-Policy"]).not.toHaveProperty("upgrade-insecure-requests");
+    expect(e2e.distDir).toBe(".next-e2e");
+
+    const production = await resolveHelper(base, "production");
+    const productionHeaders = getPath(production, "headers./:path*") as Record<string, Json>;
+    expect(productionHeaders["Strict-Transport-Security"]).toBe("max-age=31536000; includeSubDomains");
+    expect(productionHeaders["Content-Security-Policy"]).toHaveProperty("upgrade-insecure-requests");
+    expect(production.distDir).toBeUndefined();
+  });
+
+  it("reactCompiler option sets both reactCompiler and turbopackRustReactCompiler", () => {
+    const on = createNextConfig({ ...base, reactCompiler: true });
+    expect(on.reactCompiler).toBe(true);
+    expect(on.experimental?.turbopackRustReactCompiler).toBe(true);
+
+    const off = createNextConfig(base);
+    expect(off.reactCompiler).toBe(false);
+    expect(off.experimental?.turbopackRustReactCompiler).toBeUndefined();
+  });
+
+  it("securityHeaders:false returns no headers()", () => {
+    expect(createNextConfig({ ...base, securityHeaders: false }).headers).toBeUndefined();
+    expect(typeof createNextConfig(base).headers).toBe("function");
+  });
+
+  it("applies extend last, to the finished config", () => {
+    const extend = vi.fn((config) => ({ ...config, output: "standalone" as const }));
+    const config = createNextConfig({ ...base, extend });
+    expect(extend).toHaveBeenCalledWith(expect.objectContaining({ cacheComponents: true }));
+    expect(config.output).toBe("standalone");
+  });
+});
+
+describe("buildCsp", () => {
+  const env = { ...FIXED_ENV, NODE_ENV: "production" } as unknown as NodeJS.ProcessEnv;
+
+  it("allows no third-party host unless a service names it", () => {
+    const csp = parseCsp(buildCsp({}, env));
+    expect(csp["script-src"]).toEqual(["'self'", "'unsafe-eval'", "'unsafe-inline'"]);
+    expect(csp["style-src"]).toEqual(["'self'", "'unsafe-inline'"]);
+    expect(csp["font-src"]).toEqual(["'self'"]);
+    expect(csp["frame-src"]).toEqual(["'self'"]);
+    expect(csp["worker-src"]).toEqual(["'self'", "blob:"]);
+    expect(buildCsp({}, env)).not.toMatch(/stripe|google|cloudflare|discord/);
+  });
+
+  it("adds each named service's hosts to the directives it needs", () => {
+    const all = parseCsp(buildCsp({ services: ["stripe", "googleMaps", "turnstile", "discord", "googleFonts"] }, env));
+    expect(all["script-src"]).toEqual(
+      expect.arrayContaining([
+        "https://js.stripe.com",
+        "https://maps.googleapis.com",
+        "https://challenges.cloudflare.com",
+      ]),
+    );
+    expect(all["img-src"]).toEqual(
+      expect.arrayContaining([
+        "https://*.stripe.com",
+        "https://maps.googleapis.com",
+        "https://maps.gstatic.com",
+        "https://cdn.discordapp.com",
+      ]),
+    );
+    expect(all["connect-src"]).toEqual(
+      expect.arrayContaining([
+        "https://api.stripe.com",
+        "https://maps.googleapis.com",
+        "https://places.googleapis.com",
+        "https://challenges.cloudflare.com",
+      ]),
+    );
+    expect(all["frame-src"]).toEqual(
+      expect.arrayContaining([
+        "https://js.stripe.com",
+        "https://hooks.stripe.com",
+        "https://challenges.cloudflare.com",
+      ]),
+    );
+    expect(all["style-src"]).toContain("https://fonts.googleapis.com");
+    expect(all["font-src"]).toContain("https://fonts.gstatic.com");
+
+    const stripeOnly = buildCsp({ services: ["stripe"] }, env);
+    expect(stripeOnly).toContain("https://js.stripe.com");
+    expect(stripeOnly).not.toMatch(/google|cloudflare|discord/);
+  });
+
+  it("appends extra sources per directive after the services", () => {
+    const csp = parseCsp(buildCsp({ services: ["stripe"], csp: { "frame-src": ["https://docs.google.com/"] } }, env));
+    expect(csp["frame-src"]).toEqual([
+      "'self'",
+      "https://docs.google.com/",
+      "https://hooks.stripe.com",
+      "https://js.stripe.com",
+    ]);
+  });
+
+  it("derives API, websocket, address and image sources from the env", () => {
+    const csp = parseCsp(buildCsp({}, env));
+    expect(csp["connect-src"]).toEqual(
+      expect.arrayContaining(["https://api.test", "wss://api.test", "https://app.test", "https://img.test"]),
+    );
+    expect(csp["img-src"]).toContain("https://img.test");
+  });
+
+  it("drops empty sources when env values are missing", () => {
+    const value = buildCsp({ csp: { "img-src": [""] } }, { NODE_ENV: "development" } as unknown as NodeJS.ProcessEnv);
+    expect(value).not.toMatch(/\s{2,}/);
+    expect(value).not.toMatch(/ ;/);
+    expect(value).not.toContain("upgrade-insecure-requests");
+  });
+});