create-ailk 0.1.0

package/templates/apps/web/__tests__/security-headers.test.ts

@@ -0,0 +1,201 @@
+/**
+ * @jest-environment node
+ */
+// S16 — Security headers tests (#612)
+//
+// Tests the apps/web middleware that applies the 7 baseline security headers
+// and the typed customer-extension interface.
+//
+// Spec: docs/internal/specs/ailk-pre-oss-security-phase-3-s16-security-headers-spec.md
+//
+// The middleware is exercised by invoking it with a synthetic NextRequest and
+// asserting on the returned response headers. Header-shape tests live here;
+// end-to-end (live-server) CSP-block verification is documented in docs/security/csp.md
+// as a manual check and is not part of the unit test suite.
+//
+// Why node env: NextRequest / NextResponse use the Web Fetch API (Request/Response
+// globals) which are provided by Node 18+ but absent from the default jsdom
+// environment used by the rest of apps/web.
+
+import { NextRequest } from "next/server";
+
+import { middleware } from "../middleware";
+import {
+  DEFAULT_SECURITY_HEADERS,
+  applyHeaders,
+  buildHeaders,
+  type SecurityHeadersExtension,
+} from "../security-headers.config";
+
+function makeRequest(path = "/"): NextRequest {
+  return new NextRequest(new URL(path, "http://localhost:3000"));
+}
+
+describe("security headers — defaults", () => {
+  it("sets Content-Security-Policy with frame-ancestors 'none', form-action 'self', base-uri 'self'", () => {
+    const res = middleware(makeRequest());
+    const csp = res.headers.get("Content-Security-Policy");
+    expect(csp).not.toBeNull();
+    expect(csp).toContain("frame-ancestors 'none'");
+    expect(csp).toContain("form-action 'self'");
+    expect(csp).toContain("base-uri 'self'");
+    expect(csp).toContain("default-src 'self'");
+  });
+
+  it("sets Strict-Transport-Security with max-age=63072000; includeSubDomains; preload", () => {
+    const res = middleware(makeRequest());
+    expect(res.headers.get("Strict-Transport-Security")).toBe(
+      "max-age=63072000; includeSubDomains; preload",
+    );
+  });
+
+  it("sets X-Frame-Options: DENY", () => {
+    const res = middleware(makeRequest());
+    expect(res.headers.get("X-Frame-Options")).toBe("DENY");
+  });
+
+  it("sets X-Content-Type-Options: nosniff", () => {
+    const res = middleware(makeRequest());
+    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
+  });
+
+  it("sets Referrer-Policy: strict-origin-when-cross-origin", () => {
+    const res = middleware(makeRequest());
+    expect(res.headers.get("Referrer-Policy")).toBe(
+      "strict-origin-when-cross-origin",
+    );
+  });
+
+  it("sets Permissions-Policy denying camera, microphone, geolocation, interest-cohort", () => {
+    const res = middleware(makeRequest());
+    const pp = res.headers.get("Permissions-Policy");
+    expect(pp).not.toBeNull();
+    expect(pp).toContain("camera=()");
+    expect(pp).toContain("microphone=()");
+    expect(pp).toContain("geolocation=()");
+    expect(pp).toContain("interest-cohort=()");
+  });
+
+  it("sets X-DNS-Prefetch-Control: off", () => {
+    const res = middleware(makeRequest());
+    expect(res.headers.get("X-DNS-Prefetch-Control")).toBe("off");
+  });
+
+  it("applies all 7 headers on a single request", () => {
+    const res = middleware(makeRequest());
+    expect(res.headers.get("Content-Security-Policy")).not.toBeNull();
+    expect(res.headers.get("Strict-Transport-Security")).not.toBeNull();
+    expect(res.headers.get("X-Frame-Options")).not.toBeNull();
+    expect(res.headers.get("X-Content-Type-Options")).not.toBeNull();
+    expect(res.headers.get("Referrer-Policy")).not.toBeNull();
+    expect(res.headers.get("Permissions-Policy")).not.toBeNull();
+    expect(res.headers.get("X-DNS-Prefetch-Control")).not.toBeNull();
+  });
+});
+
+describe("security headers — DEFAULT_SECURITY_HEADERS export", () => {
+  it("exports the canonical default map with 7 entries", () => {
+    const keys = Object.keys(DEFAULT_SECURITY_HEADERS);
+    expect(keys).toHaveLength(7);
+    expect(keys).toEqual(
+      expect.arrayContaining([
+        "Content-Security-Policy",
+        "Strict-Transport-Security",
+        "X-Frame-Options",
+        "X-Content-Type-Options",
+        "Referrer-Policy",
+        "Permissions-Policy",
+        "X-DNS-Prefetch-Control",
+      ]),
+    );
+  });
+});
+
+describe("customer extension — additive directives", () => {
+  it("merges customer script-src directive with the baseline", () => {
+    const extension: SecurityHeadersExtension = {
+      csp: {
+        "script-src": ["https://plausible.io"],
+      },
+    };
+    const headers = buildHeaders(extension);
+    const csp = headers["Content-Security-Policy"] ?? "";
+    expect(csp).toContain("https://plausible.io");
+    // baseline still present
+    expect(csp).toContain("'self'");
+    // 'self' is not duplicated
+    expect((csp.match(/'self'/g) ?? []).length).toBeGreaterThan(0);
+  });
+
+  it("merges customer connect-src directive with the baseline", () => {
+    const extension: SecurityHeadersExtension = {
+      csp: {
+        "connect-src": ["https://api.example.com"],
+      },
+    };
+    const headers = buildHeaders(extension);
+    const csp = headers["Content-Security-Policy"] ?? "";
+    expect(csp).toContain("https://api.example.com");
+    // baseline connect-src self + Stripe stays
+    expect(csp).toContain("https://api.stripe.com");
+  });
+
+  it("baseline 'frame-ancestors none' remains when extension tries to add new csp directive", () => {
+    const extension: SecurityHeadersExtension = {
+      csp: {
+        "img-src": ["https://images.example.com"],
+      },
+    };
+    const headers = buildHeaders(extension);
+    const csp = headers["Content-Security-Policy"] ?? "";
+    expect(csp).toContain("frame-ancestors 'none'");
+    expect(csp).toContain("base-uri 'self'");
+  });
+});
+
+describe("customer extension — protected directives", () => {
+  it("refuses to relax frame-ancestors (locked at 'none')", () => {
+    const extension: SecurityHeadersExtension = {
+      csp: {
+        // attempt to widen frame-ancestors — must be rejected
+        "frame-ancestors": ["https://embedder.example.com"],
+      },
+    };
+    expect(() => buildHeaders(extension)).toThrow(
+      /frame-ancestors.*locked|cannot.*frame-ancestors/i,
+    );
+  });
+
+  it("refuses to relax base-uri (locked at 'self')", () => {
+    const extension: SecurityHeadersExtension = {
+      csp: {
+        "base-uri": ["https://example.com"],
+      },
+    };
+    expect(() => buildHeaders(extension)).toThrow(
+      /base-uri.*locked|cannot.*base-uri/i,
+    );
+  });
+
+  it("refuses to relax HSTS (locked baseline)", () => {
+    // Simulates a customer wiring extension via untyped JSON config, smuggling
+    // an `hsts` key past the TypeScript boundary. buildHeaders catches it.
+    // eslint-disable-next-line no-restricted-syntax -- #612: JSON-bypass simulation
+    const extension = { hsts: "max-age=300" } as unknown as SecurityHeadersExtension;
+    expect(() => buildHeaders(extension)).toThrow(
+      /Strict-Transport-Security|HSTS/i,
+    );
+  });
+});
+
+describe("applyHeaders helper", () => {
+  it("writes every header from a map onto a Headers object", () => {
+    const headers = new Headers();
+    applyHeaders(headers, {
+      "X-Test-A": "alpha",
+      "X-Test-B": "beta",
+    });
+    expect(headers.get("X-Test-A")).toBe("alpha");
+    expect(headers.get("X-Test-B")).toBe("beta");
+  });
+});

package/templates/apps/web/__tests__/sentry-config.test.ts

@@ -0,0 +1,116 @@
+// Tests for the env-driven Sentry config files in apps/web (#894).
+// All three runtime configs (client, server, edge) gate on the DSN env var —
+// when DSN is set, Sentry.init() is called with `enabled: true`; when unset,
+// `enabled: false` and the SDK becomes a no-op.
+//
+// Mocking @sentry/nextjs is allowed by the no-restricted-syntax rule
+// (external module). Mocking internal modules with `jest.mock('../foo')` is
+// not allowed; this test mocks the public Sentry boundary instead.
+
+const initMock = jest.fn();
+jest.mock("@sentry/nextjs", () => ({
+  init: initMock,
+}));
+
+describe("apps/web — Sentry config (#894)", () => {
+  const originalServerDsn = process.env.SENTRY_DSN;
+  const originalClientDsn = process.env.NEXT_PUBLIC_SENTRY_DSN;
+
+  beforeEach(() => {
+    initMock.mockReset();
+  });
+
+  afterEach(() => {
+    if (originalServerDsn === undefined) {
+      delete process.env.SENTRY_DSN;
+    } else {
+      process.env.SENTRY_DSN = originalServerDsn;
+    }
+    if (originalClientDsn === undefined) {
+      delete process.env.NEXT_PUBLIC_SENTRY_DSN;
+    } else {
+      process.env.NEXT_PUBLIC_SENTRY_DSN = originalClientDsn;
+    }
+    jest.resetModules();
+  });
+
+  describe("sentry.client.config.ts", () => {
+    it("calls Sentry.init with enabled=true when NEXT_PUBLIC_SENTRY_DSN is set", () => {
+      jest.isolateModules(() => {
+        process.env.NEXT_PUBLIC_SENTRY_DSN =
+          "https://test@o1.ingest.sentry.io/1";
+        require("../sentry.client.config");
+        expect(initMock).toHaveBeenCalledTimes(1);
+        const opts = initMock.mock.calls[0]![0] as {
+          dsn?: string;
+          enabled: boolean;
+        };
+        expect(opts.enabled).toBe(true);
+        expect(opts.dsn).toBe("https://test@o1.ingest.sentry.io/1");
+      });
+    });
+
+    it("calls Sentry.init with enabled=false when NEXT_PUBLIC_SENTRY_DSN is unset", () => {
+      jest.isolateModules(() => {
+        delete process.env.NEXT_PUBLIC_SENTRY_DSN;
+        require("../sentry.client.config");
+        expect(initMock).toHaveBeenCalledTimes(1);
+        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
+        expect(opts.enabled).toBe(false);
+      });
+    });
+
+    it("calls Sentry.init with enabled=false when NEXT_PUBLIC_SENTRY_DSN is empty", () => {
+      jest.isolateModules(() => {
+        process.env.NEXT_PUBLIC_SENTRY_DSN = "";
+        require("../sentry.client.config");
+        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
+        expect(opts.enabled).toBe(false);
+      });
+    });
+  });
+
+  describe("sentry.server.config.ts", () => {
+    it("calls Sentry.init with enabled=true when SENTRY_DSN is set", () => {
+      jest.isolateModules(() => {
+        process.env.SENTRY_DSN = "https://test@o1.ingest.sentry.io/2";
+        require("../sentry.server.config");
+        const opts = initMock.mock.calls[0]![0] as {
+          dsn?: string;
+          enabled: boolean;
+        };
+        expect(opts.enabled).toBe(true);
+        expect(opts.dsn).toBe("https://test@o1.ingest.sentry.io/2");
+      });
+    });
+
+    it("calls Sentry.init with enabled=false when SENTRY_DSN is unset", () => {
+      jest.isolateModules(() => {
+        delete process.env.SENTRY_DSN;
+        require("../sentry.server.config");
+        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
+        expect(opts.enabled).toBe(false);
+      });
+    });
+  });
+
+  describe("sentry.edge.config.ts", () => {
+    it("calls Sentry.init with enabled=true when SENTRY_DSN is set", () => {
+      jest.isolateModules(() => {
+        process.env.SENTRY_DSN = "https://test@o1.ingest.sentry.io/3";
+        require("../sentry.edge.config");
+        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
+        expect(opts.enabled).toBe(true);
+      });
+    });
+
+    it("calls Sentry.init with enabled=false when SENTRY_DSN is unset", () => {
+      jest.isolateModules(() => {
+        delete process.env.SENTRY_DSN;
+        require("../sentry.edge.config");
+        const opts = initMock.mock.calls[0]![0] as { enabled: boolean };
+        expect(opts.enabled).toBe(false);
+      });
+    });
+  });
+});

package/templates/apps/web/__tests__/setup.ts

@@ -0,0 +1,82 @@
+import "@testing-library/jest-dom";
+
+// jsdom does not implement window.matchMedia. Provide a minimal stub so any
+// component that calls matchMedia (e.g. ThemeToggle via Nav) can run
+// in tests without crashing. Guard with typeof so server-environment tests
+// that lack a window object are unaffected.
+if (typeof window !== "undefined") {
+  /* eslint-disable no-restricted-syntax -- jsdom stub cannot fully implement MediaQueryList; double-cast is unavoidable in a global setup file */
+  Object.defineProperty(window, "matchMedia", {
+    writable: true,
+    value: (query: string): MediaQueryList =>
+      ({
+        matches: false,
+        media: query,
+        onchange: null,
+        addEventListener: jest.fn(),
+        removeEventListener: jest.fn(),
+        addListener: jest.fn(),
+        removeListener: jest.fn(),
+        dispatchEvent: jest.fn(),
+      }) as unknown as MediaQueryList,
+  });
+  /* eslint-enable no-restricted-syntax */
+}
+
+// next-intl/server and next-intl rely on the Next.js request context and cannot
+// be called directly in jsdom tests. Provide a lightweight mock backed by the
+// real en.json message catalog so page components that call getTranslations /
+// useTranslations receive actual string values. ADR 0019.
+jest.mock("next-intl/server", () => {
+   
+  const msgs: Record<string, Record<string, string>> = require("../messages/en.json");
+  return {
+    __esModule: true,
+    // Handles both call forms used in apps/web routes:
+    //   getTranslations("namespace")           — pre-migration routes
+    //   getTranslations({ namespace, locale }) — renderPage (post-migration)
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = msgs[ns];
+      return (key: string): string => messages?.[key] ?? `${ns}.${key}`;
+    },
+    getRequestConfig: (fn: unknown) => fn,
+  };
+});
+
+jest.mock("next-intl", () => {
+   
+  const msgs: Record<string, Record<string, string>> = require("../messages/en.json");
+  return {
+    __esModule: true,
+    useTranslations: (namespace: string) => (key: string): string => {
+      const ns = msgs[namespace];
+      return ns?.[key] ?? `${namespace}.${key}`;
+    },
+  };
+});
+
+// @working-theory/schema-pack-registry loads jose (ESM-only) transitively via @working-theory/license.
+// The web test suite never needs the real network/license stack — mock the
+// entire package so nothing in the jose chain is required during tests.
+// Individual tests that need specific behaviour (e.g. json-ld.test.ts) override
+// with jest.doMock() after jest.resetModules() to inject their own mock values.
+jest.mock("@working-theory/schema-pack-registry", () => ({
+  __esModule: true,
+  getCurrentPack: jest.fn(),
+  applyPack: jest.fn((_name: string, output: unknown) => ({
+    result: output,
+    fellBack: false,
+  })),
+  applyRegistryDeltas: jest.fn(
+    <T>(registry: T[]) => registry,
+  ),
+  getBuiltInPack: jest.fn(() => ({
+    version: "2026.01.01",
+    schemaApiVersion: 1,
+    publishedAt: "2026-01-01T00:00:00.000Z",
+    patches: {},
+    registryDeltas: [],
+    signature: "built-in",
+  })),
+}));