create-ailk 0.1.0 → 0.2.0

package/templates/apps/web/__tests__/security-headers.test.ts

@@ -1,201 +0,0 @@
-/**
- * @jest-environment node
- */
-// S16 — Security headers tests (#612)
-//
-// Tests the apps/web middleware that applies the 7 baseline security headers
-// and the typed customer-extension interface.
-//
-// Spec: docs/internal/specs/ailk-pre-oss-security-phase-3-s16-security-headers-spec.md
-//
-// The middleware is exercised by invoking it with a synthetic NextRequest and
-// asserting on the returned response headers. Header-shape tests live here;
-// end-to-end (live-server) CSP-block verification is documented in docs/security/csp.md
-// as a manual check and is not part of the unit test suite.
-//
-// Why node env: NextRequest / NextResponse use the Web Fetch API (Request/Response
-// globals) which are provided by Node 18+ but absent from the default jsdom
-// environment used by the rest of apps/web.
-
-import { NextRequest } from "next/server";
-
-import { middleware } from "../middleware";
-import {
-  DEFAULT_SECURITY_HEADERS,
-  applyHeaders,
-  buildHeaders,
-  type SecurityHeadersExtension,
-} from "../security-headers.config";
-
-function makeRequest(path = "/"): NextRequest {
-  return new NextRequest(new URL(path, "http://localhost:3000"));
-}
-
-describe("security headers — defaults", () => {
-  it("sets Content-Security-Policy with frame-ancestors 'none', form-action 'self', base-uri 'self'", () => {
-    const res = middleware(makeRequest());
-    const csp = res.headers.get("Content-Security-Policy");
-    expect(csp).not.toBeNull();
-    expect(csp).toContain("frame-ancestors 'none'");
-    expect(csp).toContain("form-action 'self'");
-    expect(csp).toContain("base-uri 'self'");
-    expect(csp).toContain("default-src 'self'");
-  });
-
-  it("sets Strict-Transport-Security with max-age=63072000; includeSubDomains; preload", () => {
-    const res = middleware(makeRequest());
-    expect(res.headers.get("Strict-Transport-Security")).toBe(
-      "max-age=63072000; includeSubDomains; preload",
-    );
-  });
-
-  it("sets X-Frame-Options: DENY", () => {
-    const res = middleware(makeRequest());
-    expect(res.headers.get("X-Frame-Options")).toBe("DENY");
-  });
-
-  it("sets X-Content-Type-Options: nosniff", () => {
-    const res = middleware(makeRequest());
-    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
-  });
-
-  it("sets Referrer-Policy: strict-origin-when-cross-origin", () => {
-    const res = middleware(makeRequest());
-    expect(res.headers.get("Referrer-Policy")).toBe(
-      "strict-origin-when-cross-origin",
-    );
-  });
-
-  it("sets Permissions-Policy denying camera, microphone, geolocation, interest-cohort", () => {
-    const res = middleware(makeRequest());
-    const pp = res.headers.get("Permissions-Policy");
-    expect(pp).not.toBeNull();
-    expect(pp).toContain("camera=()");
-    expect(pp).toContain("microphone=()");
-    expect(pp).toContain("geolocation=()");
-    expect(pp).toContain("interest-cohort=()");
-  });
-
-  it("sets X-DNS-Prefetch-Control: off", () => {
-    const res = middleware(makeRequest());
-    expect(res.headers.get("X-DNS-Prefetch-Control")).toBe("off");
-  });
-
-  it("applies all 7 headers on a single request", () => {
-    const res = middleware(makeRequest());
-    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
-    expect(res.headers.get("Strict-Transport-Security")).not.toBeNull();
-    expect(res.headers.get("X-Frame-Options")).not.toBeNull();
-    expect(res.headers.get("X-Content-Type-Options")).not.toBeNull();
-    expect(res.headers.get("Referrer-Policy")).not.toBeNull();
-    expect(res.headers.get("Permissions-Policy")).not.toBeNull();
-    expect(res.headers.get("X-DNS-Prefetch-Control")).not.toBeNull();
-  });
-});
-
-describe("security headers — DEFAULT_SECURITY_HEADERS export", () => {
-  it("exports the canonical default map with 7 entries", () => {
-    const keys = Object.keys(DEFAULT_SECURITY_HEADERS);
-    expect(keys).toHaveLength(7);
-    expect(keys).toEqual(
-      expect.arrayContaining([
-        "Content-Security-Policy",
-        "Strict-Transport-Security",
-        "X-Frame-Options",
-        "X-Content-Type-Options",
-        "Referrer-Policy",
-        "Permissions-Policy",
-        "X-DNS-Prefetch-Control",
-      ]),
-    );
-  });
-});
-
-describe("customer extension — additive directives", () => {
-  it("merges customer script-src directive with the baseline", () => {
-    const extension: SecurityHeadersExtension = {
-      csp: {
-        "script-src": ["https://plausible.io"],
-      },
-    };
-    const headers = buildHeaders(extension);
-    const csp = headers["Content-Security-Policy"] ?? "";
-    expect(csp).toContain("https://plausible.io");
-    // baseline still present
-    expect(csp).toContain("'self'");
-    // 'self' is not duplicated
-    expect((csp.match(/'self'/g) ?? []).length).toBeGreaterThan(0);
-  });
-
-  it("merges customer connect-src directive with the baseline", () => {
-    const extension: SecurityHeadersExtension = {
-      csp: {
-        "connect-src": ["https://api.example.com"],
-      },
-    };
-    const headers = buildHeaders(extension);
-    const csp = headers["Content-Security-Policy"] ?? "";
-    expect(csp).toContain("https://api.example.com");
-    // baseline connect-src self + Stripe stays
-    expect(csp).toContain("https://api.stripe.com");
-  });
-
-  it("baseline 'frame-ancestors none' remains when extension tries to add new csp directive", () => {
-    const extension: SecurityHeadersExtension = {
-      csp: {
-        "img-src": ["https://images.example.com"],
-      },
-    };
-    const headers = buildHeaders(extension);
-    const csp = headers["Content-Security-Policy"] ?? "";
-    expect(csp).toContain("frame-ancestors 'none'");
-    expect(csp).toContain("base-uri 'self'");
-  });
-});
-
-describe("customer extension — protected directives", () => {
-  it("refuses to relax frame-ancestors (locked at 'none')", () => {
-    const extension: SecurityHeadersExtension = {
-      csp: {
-        // attempt to widen frame-ancestors — must be rejected
-        "frame-ancestors": ["https://embedder.example.com"],
-      },
-    };
-    expect(() => buildHeaders(extension)).toThrow(
-      /frame-ancestors.*locked|cannot.*frame-ancestors/i,
-    );
-  });
-
-  it("refuses to relax base-uri (locked at 'self')", () => {
-    const extension: SecurityHeadersExtension = {
-      csp: {
-        "base-uri": ["https://example.com"],
-      },
-    };
-    expect(() => buildHeaders(extension)).toThrow(
-      /base-uri.*locked|cannot.*base-uri/i,
-    );
-  });
-
-  it("refuses to relax HSTS (locked baseline)", () => {
-    // Simulates a customer wiring extension via untyped JSON config, smuggling
-    // an `hsts` key past the TypeScript boundary. buildHeaders catches it.
-    // eslint-disable-next-line no-restricted-syntax -- #612: JSON-bypass simulation
-    const extension = { hsts: "max-age=300" } as unknown as SecurityHeadersExtension;
-    expect(() => buildHeaders(extension)).toThrow(
-      /Strict-Transport-Security|HSTS/i,
-    );
-  });
-});
-
-describe("applyHeaders helper", () => {
-  it("writes every header from a map onto a Headers object", () => {
-    const headers = new Headers();
-    applyHeaders(headers, {
-      "X-Test-A": "alpha",
-      "X-Test-B": "beta",
-    });
-    expect(headers.get("X-Test-A")).toBe("alpha");
-    expect(headers.get("X-Test-B")).toBe("beta");
-  });
-});

package/templates/apps/web/__tests__/sentry-config.test.ts

@@ -1,116 +0,0 @@
-// Tests for the env-driven Sentry config files in apps/web (#894).
-// All three runtime configs (client, server, edge) gate on the DSN env var —
-// when DSN is set, Sentry.init() is called with `enabled: true`; when unset,
-// `enabled: false` and the SDK becomes a no-op.
-//
-// Mocking @sentry/nextjs is allowed by the no-restricted-syntax rule
-// (external module). Mocking internal modules with `jest.mock('../foo')` is
-// not allowed; this test mocks the public Sentry boundary instead.
-
-const initMock = jest.fn();
-jest.mock("@sentry/nextjs", () => ({
-  init: initMock,
-}));
-
-describe("apps/web — Sentry config (#894)", () => {
-  const originalServerDsn = process.env.SENTRY_DSN;
-  const originalClientDsn = process.env.NEXT_PUBLIC_SENTRY_DSN;
-
-  beforeEach(() => {
-    initMock.mockReset();
-  });
-
-  afterEach(() => {
-    if (originalServerDsn === undefined) {
-      delete process.env.SENTRY_DSN;
-    } else {
-      process.env.SENTRY_DSN = originalServerDsn;
-    }
-    if (originalClientDsn === undefined) {
-      delete process.env.NEXT_PUBLIC_SENTRY_DSN;
-    } else {
-      process.env.NEXT_PUBLIC_SENTRY_DSN = originalClientDsn;
-    }
-    jest.resetModules();
-  });
-
-  describe("sentry.client.config.ts", () => {
-    it("calls Sentry.init with enabled=true when NEXT_PUBLIC_SENTRY_DSN is set", () => {
-      jest.isolateModules(() => {
-        process.env.NEXT_PUBLIC_SENTRY_DSN =
-          "https://test@o1.ingest.sentry.io/1";
-        require("../sentry.client.config");
-        expect(initMock).toHaveBeenCalledTimes(1);
-        const opts = initMock.mock.calls[0]![0] as {
-          dsn?: string;
-          enabled: boolean;
-        };
-        expect(opts.enabled).toBe(true);
-        expect(opts.dsn).toBe("https://test@o1.ingest.sentry.io/1");
-      });
-    });
-
-    it("calls Sentry.init with enabled=false when NEXT_PUBLIC_SENTRY_DSN is unset", () => {
-      jest.isolateModules(() => {
-        delete process.env.NEXT_PUBLIC_SENTRY_DSN;
-        require("../sentry.client.config");
-        expect(initMock).toHaveBeenCalledTimes(1);
-        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
-        expect(opts.enabled).toBe(false);
-      });
-    });
-
-    it("calls Sentry.init with enabled=false when NEXT_PUBLIC_SENTRY_DSN is empty", () => {
-      jest.isolateModules(() => {
-        process.env.NEXT_PUBLIC_SENTRY_DSN = "";
-        require("../sentry.client.config");
-        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
-        expect(opts.enabled).toBe(false);
-      });
-    });
-  });
-
-  describe("sentry.server.config.ts", () => {
-    it("calls Sentry.init with enabled=true when SENTRY_DSN is set", () => {
-      jest.isolateModules(() => {
-        process.env.SENTRY_DSN = "https://test@o1.ingest.sentry.io/2";
-        require("../sentry.server.config");
-        const opts = initMock.mock.calls[0]![0] as {
-          dsn?: string;
-          enabled: boolean;
-        };
-        expect(opts.enabled).toBe(true);
-        expect(opts.dsn).toBe("https://test@o1.ingest.sentry.io/2");
-      });
-    });
-
-    it("calls Sentry.init with enabled=false when SENTRY_DSN is unset", () => {
-      jest.isolateModules(() => {
-        delete process.env.SENTRY_DSN;
-        require("../sentry.server.config");
-        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
-        expect(opts.enabled).toBe(false);
-      });
-    });
-  });
-
-  describe("sentry.edge.config.ts", () => {
-    it("calls Sentry.init with enabled=true when SENTRY_DSN is set", () => {
-      jest.isolateModules(() => {
-        process.env.SENTRY_DSN = "https://test@o1.ingest.sentry.io/3";
-        require("../sentry.edge.config");
-        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
-        expect(opts.enabled).toBe(true);
-      });
-    });
-
-    it("calls Sentry.init with enabled=false when SENTRY_DSN is unset", () => {
-      jest.isolateModules(() => {
-        delete process.env.SENTRY_DSN;
-        require("../sentry.edge.config");
-        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
-        expect(opts.enabled).toBe(false);
-      });
-    });
-  });
-});