@cronn/playwright-utils 0.10.0 → 0.11.0

package/dist/index.d.mts

@@ -618,9 +618,9 @@ export declare function getCspHeader(response: Response | null): Promise<string>
  */
 export declare function cspReport(header: string): string;
 //#endregion
-//#region src/security/response-header-report.d.ts
+//#region src/security/response-headers-report.d.ts
 type ResponseHeaderType = "document" | "api";
-interface ResponseHeaderReportOptions {
+interface ResponseHeadersReportOptions {
   type: ResponseHeaderType;
 }
 /**
@@ -643,12 +643,12 @@ export declare function getResponseHeaders(response: Response | APIResponse | nu
  * const response = await page.goto("/");
  * const headers = await getResponseHeaders(response);
  *
- * expect(responseHeaderReport(headers, { type: "document" })).toMatchTextFile({
+ * expect(responseHeadersReport(headers, { type: "document" })).toMatchTextFile({
  *   fileExtension: "md",
  * });
  * ```
  */
-export declare function responseHeaderReport(headers: Record<string, string>, options: ResponseHeaderReportOptions): string;
+export declare function responseHeadersReport(headers: Record<string, string>, options: ResponseHeadersReportOptions): string;
 //#endregion
 //#region src/file.d.ts
 /**
@@ -789,4 +789,4 @@ export declare function maskedValueWithIndex(name: string): (index: number) => s
  */
 type PlaywrightTarget = Page | Locator;
 //#endregion
-export type { ConsoleMessageFilter, ConsoleMessageLevel, CspFixtures, CspViolation, ExtendedLocator, FormFields, HttpMethod, PlaywrightTarget, ResponseHandler, ResponseHeaderReportOptions, ResponseHeaderType, RoleLocators, RouteFilter };
+export type { ConsoleMessageFilter, ConsoleMessageLevel, CspFixtures, CspViolation, ExtendedLocator, FormFields, HttpMethod, PlaywrightTarget, ResponseHandler, ResponseHeaderType, ResponseHeadersReportOptions, RoleLocators, RouteFilter };

package/dist/index.mjs

@@ -1028,7 +1028,7 @@ function formatValues(values) {
 	return codeOrNone(values.join(" "));
 }
 //#endregion
-//#region src/security/response-header-report.ts
+//#region src/security/response-headers-report.ts
 const ACTION_ORDER = [
 	"add",
 	"change",
@@ -1036,32 +1036,35 @@ const ACTION_ORDER = [
 ];
 const MIN_HSTS_MAX_AGE = 31536e3;
 const PERMISSIONS_POLICY = "geolocation=(), microphone=(), camera=()";
-const RECOMMENDED_COMMON_HEADERS = [
-	{ name: "cache-control" },
-	{ name: "content-security-policy" },
-	{ name: "content-type" },
-	{
-		name: "cross-origin-opener-policy",
-		recommended: "same-origin"
-	},
-	{
-		name: "cross-origin-resource-policy",
-		recommended: "same-origin"
-	},
-	{
-		name: "strict-transport-security",
-		recommended: `max-age=${MIN_HSTS_MAX_AGE}; includeSubDomains`,
-		isAccepted: isStrictHsts
-	},
-	{
-		name: "x-content-type-options",
-		recommended: "nosniff"
-	},
-	{ name: "x-robots-tag" }
-];
+const API_CSP = "frame-ancestors 'none'";
+function recommendedCommonHeaders(csp) {
+	return [
+		{ name: "cache-control" },
+		csp,
+		{ name: "content-type" },
+		{
+			name: "cross-origin-opener-policy",
+			recommended: "same-origin"
+		},
+		{
+			name: "cross-origin-resource-policy",
+			recommended: "same-origin"
+		},
+		{
+			name: "strict-transport-security",
+			recommended: `max-age=${MIN_HSTS_MAX_AGE}; includeSubDomains`,
+			isAccepted: isStrictHsts
+		},
+		{
+			name: "x-content-type-options",
+			recommended: "nosniff"
+		},
+		{ name: "x-robots-tag" }
+	];
+}
 const DISCOURAGED_COMMON_HEADERS = ["access-control-allow-origin"];
 const RECOMMENDED_DOCUMENT_HEADERS = [
-	...RECOMMENDED_COMMON_HEADERS,
+	...recommendedCommonHeaders({ name: "content-security-policy" }),
 	{
 		name: "permissions-policy",
 		recommended: PERMISSIONS_POLICY,
@@ -1076,10 +1079,15 @@ const RECOMMENDED_DOCUMENT_HEADERS = [
 		recommended: "DENY"
 	}
 ];
+const RECOMMENDED_API_HEADERS = recommendedCommonHeaders({
+	name: "content-security-policy",
+	recommended: API_CSP,
+	isAccepted: hasApiCspDirectives
+});
 const DISCOURAGED_DOCUMENT_HEADERS = [...DISCOURAGED_COMMON_HEADERS, "x-xss-protection"];
 const RECOMMENDED_HEADERS = {
 	document: RECOMMENDED_DOCUMENT_HEADERS,
-	api: RECOMMENDED_COMMON_HEADERS
+	api: RECOMMENDED_API_HEADERS
 };
 const DISCOURAGED_HEADERS = {
 	document: DISCOURAGED_DOCUMENT_HEADERS,
@@ -1108,12 +1116,12 @@ async function getResponseHeaders(response) {
 * const response = await page.goto("/");
 * const headers = await getResponseHeaders(response);
 *
-* expect(responseHeaderReport(headers, { type: "document" })).toMatchTextFile({
+* expect(responseHeadersReport(headers, { type: "document" })).toMatchTextFile({
 *   fileExtension: "md",
 * });
 * ```
 */
-function responseHeaderReport(headers, options) {
+function responseHeadersReport(headers, options) {
 	const recommendedHeaders = RECOMMENDED_HEADERS[options.type];
 	const discouragedHeaders = DISCOURAGED_HEADERS[options.type];
 	const headersByName = new Map(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]));
@@ -1129,7 +1137,7 @@ function responseHeaderReport(headers, options) {
 		action: "remove",
 		message: "Remove header"
 	}))].sort((a, b) => ACTION_ORDER.indexOf(a.action) - ACTION_ORDER.indexOf(b.action));
-	return markdownDocument("Response Header Report", [{
+	return markdownDocument("Response Headers Report", [{
 		heading: "Detected Headers",
 		content: markdownTableOrNone(["Header", "Value"], detectedHeaders.map((header) => [code(header.name), formatValue(header)]))
 	}, {
@@ -1164,6 +1172,15 @@ function isStrictHsts(value) {
 	return maxAge !== void 0 && Number(maxAge) >= MIN_HSTS_MAX_AGE && directives.includes("includesubdomains");
 }
 /**
+* Accepts a policy if it contains the recommended directives, so stricter
+* policies with further directives like `default-src 'none'` are accepted as
+* well.
+*/
+function hasApiCspDirectives(value) {
+	const actualDirectives = normalizeValue(value).split("; ");
+	return normalizeValue(API_CSP).split("; ").every((directive) => actualDirectives.includes(directive));
+}
+/**
 * Accepts a policy if it restricts at least the recommended permissions, so
 * stricter policies restricting further permissions are accepted as well.
 */
@@ -1420,4 +1437,4 @@ function identity(value) {
 	return value;
 }
 //#endregion
-export { ConsoleCaptor, CspCaptor, RouteInterceptor, RouteInterceptorFixture, captureConsole, captureCspViolations, createFetchAdapter, cspFixtures, cspReport, extendLocator, formFiller, getCspHeader, getResponseHeaders, hasLogLevel, interceptRoute, isCI, maskBaseURL, maskedValue, maskedValueWithIndex, matchPath, modifyJsonBody, modifyTextBody, resolveFromPackageRoot, responseHeaderReport, roleLocators };
+export { ConsoleCaptor, CspCaptor, RouteInterceptor, RouteInterceptorFixture, captureConsole, captureCspViolations, createFetchAdapter, cspFixtures, cspReport, extendLocator, formFiller, getCspHeader, getResponseHeaders, hasLogLevel, interceptRoute, isCI, maskBaseURL, maskedValue, maskedValueWithIndex, matchPath, modifyJsonBody, modifyTextBody, resolveFromPackageRoot, responseHeadersReport, roleLocators };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cronn/playwright-utils",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Utilities for writing tests with Playwright",
   "keywords": [
     "playwright",
@@ -37,25 +37,25 @@
     "@changesets/cli": "3.0.3",
     "@cronn/element-snapshot": "0.32.1",
     "@cronn/playwright-file-snapshots": "2.2.2",
-    "@playwright/test": "1.63.0",
-    "@types/node": "24.19.1",
+    "@playwright/test": "1.64.0",
+    "@types/node": "24.19.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitest/coverage-v8": "5.0.3",
     "eslint": "10.12.0",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-check-file": "3.3.2",
     "eslint-plugin-unused-imports": "4.4.1",
-    "knip": "6.39.0",
+    "knip": "6.41.0",
     "oxc-minify": "0.153.0",
     "oxfmt": "0.72.0",
     "publint": "0.3.25",
     "rimraf": "6.1.3",
-    "tsdown": "0.23.0",
+    "tsdown": "0.23.1",
     "turbo": "2.11.7",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "8.71.1",
     "vitepress": "2.0.0-alpha.20",
-    "vitepress-plugin-group-icons": "1.7.6",
+    "vitepress-plugin-group-icons": "1.7.7",
     "vitest": "5.0.3"
   },
   "peerDependencies": {