@cronn/playwright-utils 0.10.1 → 0.11.0

package/dist/index.mjs

@@ -1036,32 +1036,35 @@ const ACTION_ORDER = [
 ];
 const MIN_HSTS_MAX_AGE = 31536e3;
 const PERMISSIONS_POLICY = "geolocation=(), microphone=(), camera=()";
-const RECOMMENDED_COMMON_HEADERS = [
-	{ name: "cache-control" },
-	{ name: "content-security-policy" },
-	{ name: "content-type" },
-	{
-		name: "cross-origin-opener-policy",
-		recommended: "same-origin"
-	},
-	{
-		name: "cross-origin-resource-policy",
-		recommended: "same-origin"
-	},
-	{
-		name: "strict-transport-security",
-		recommended: `max-age=${MIN_HSTS_MAX_AGE}; includeSubDomains`,
-		isAccepted: isStrictHsts
-	},
-	{
-		name: "x-content-type-options",
-		recommended: "nosniff"
-	},
-	{ name: "x-robots-tag" }
-];
+const API_CSP = "frame-ancestors 'none'";
+function recommendedCommonHeaders(csp) {
+	return [
+		{ name: "cache-control" },
+		csp,
+		{ name: "content-type" },
+		{
+			name: "cross-origin-opener-policy",
+			recommended: "same-origin"
+		},
+		{
+			name: "cross-origin-resource-policy",
+			recommended: "same-origin"
+		},
+		{
+			name: "strict-transport-security",
+			recommended: `max-age=${MIN_HSTS_MAX_AGE}; includeSubDomains`,
+			isAccepted: isStrictHsts
+		},
+		{
+			name: "x-content-type-options",
+			recommended: "nosniff"
+		},
+		{ name: "x-robots-tag" }
+	];
+}
 const DISCOURAGED_COMMON_HEADERS = ["access-control-allow-origin"];
 const RECOMMENDED_DOCUMENT_HEADERS = [
-	...RECOMMENDED_COMMON_HEADERS,
+	...recommendedCommonHeaders({ name: "content-security-policy" }),
 	{
 		name: "permissions-policy",
 		recommended: PERMISSIONS_POLICY,
@@ -1076,10 +1079,15 @@ const RECOMMENDED_DOCUMENT_HEADERS = [
 		recommended: "DENY"
 	}
 ];
+const RECOMMENDED_API_HEADERS = recommendedCommonHeaders({
+	name: "content-security-policy",
+	recommended: API_CSP,
+	isAccepted: hasApiCspDirectives
+});
 const DISCOURAGED_DOCUMENT_HEADERS = [...DISCOURAGED_COMMON_HEADERS, "x-xss-protection"];
 const RECOMMENDED_HEADERS = {
 	document: RECOMMENDED_DOCUMENT_HEADERS,
-	api: RECOMMENDED_COMMON_HEADERS
+	api: RECOMMENDED_API_HEADERS
 };
 const DISCOURAGED_HEADERS = {
 	document: DISCOURAGED_DOCUMENT_HEADERS,
@@ -1164,6 +1172,15 @@ function isStrictHsts(value) {
 	return maxAge !== void 0 && Number(maxAge) >= MIN_HSTS_MAX_AGE && directives.includes("includesubdomains");
 }
 /**
+* Accepts a policy if it contains the recommended directives, so stricter
+* policies with further directives like `default-src 'none'` are accepted as
+* well.
+*/
+function hasApiCspDirectives(value) {
+	const actualDirectives = normalizeValue(value).split("; ");
+	return normalizeValue(API_CSP).split("; ").every((directive) => actualDirectives.includes(directive));
+}
+/**
 * Accepts a policy if it restricts at least the recommended permissions, so
 * stricter policies restricting further permissions are accepted as well.
 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cronn/playwright-utils",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Utilities for writing tests with Playwright",
   "keywords": [
     "playwright",
@@ -37,25 +37,25 @@
     "@changesets/cli": "3.0.3",
     "@cronn/element-snapshot": "0.32.1",
     "@cronn/playwright-file-snapshots": "2.2.2",
-    "@playwright/test": "1.63.0",
-    "@types/node": "24.19.1",
+    "@playwright/test": "1.64.0",
+    "@types/node": "24.19.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitest/coverage-v8": "5.0.3",
     "eslint": "10.12.0",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-check-file": "3.3.2",
     "eslint-plugin-unused-imports": "4.4.1",
-    "knip": "6.39.0",
+    "knip": "6.41.0",
     "oxc-minify": "0.153.0",
     "oxfmt": "0.72.0",
     "publint": "0.3.25",
     "rimraf": "6.1.3",
-    "tsdown": "0.23.0",
+    "tsdown": "0.23.1",
     "turbo": "2.11.7",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "8.71.1",
     "vitepress": "2.0.0-alpha.20",
-    "vitepress-plugin-group-icons": "1.7.6",
+    "vitepress-plugin-group-icons": "1.7.7",
     "vitest": "5.0.3"
   },
   "peerDependencies": {