# frozen_string_literal: true

# Copyright 2015-2017, the Linux Foundation, IDA, and the
# CII Best Practices badge contributors
# SPDX-License-Identifier: MIT

require 'test_helper'

class ProjectGetTest < ActionDispatch::IntegrationTest
  setup do
    # @user = users(:test_user)
    @project_one = projects(:one)
  end

  # rubocop:disable Metrics/BlockLength
  test 'ensure getting project has expected values (esp. security headers)' do
    # Check project page values, primarily the various hardening headers
    # (in particular the Content Security Policy (CSP) header).
    # We want to make sure these headers maximally limit what browsers will
    # do as an important hardening measure.
    # The "projects" page is the page most at risk of malicious data
    # from untrusted users, so we specifically test
    # the headers for this most-at-risk page.
    # We have to do this as an integration test, not as a controller test,
    # because the secure_headers gem integrates at the Rack level
    # (thus a controller test does not invoke it).

    get project_path(id: @project_one.id)
    assert_response :success

    # Check some normal headers
    assert_equal('text/html; charset=utf-8', @response.headers['Content-Type'])
    assert_equal(
      'max-age=0, private, must-revalidate',
      @response.headers['Cache-Control']
    )

    # Check hardening headers
    assert_equal(
      "default-src 'self'; base-uri 'self'; block-all-mixed-content; " \
      "form-action 'self'; frame-ancestors 'none'; " \
      "img-src secure.gravatar.com avatars.githubusercontent.com 'self'; " \
      "object-src 'none'; style-src 'self'",
      @response.headers['Content-Security-Policy']
    )
    assert_equal(
      'no-referrer-when-downgrade',
      @response.headers['Referrer-Policy']
    )
    assert_equal(
      'nosniff',
      @response.headers['X-Content-Type-Options']
    )
    assert_equal(
      'DENY',
      @response.headers['X-Frame-Options']
    )
    assert_equal(
      'none',
      @response.headers['X-Permitted-Cross-Domain-Policies']
    )
    assert_equal(
      '1; mode=block',
      @response.headers['X-XSS-Protection']
    )
  end
  # rubocop:enable Metrics/BlockLength
end

Add new integration test: Check get project (esp. CSP values)
Add new integration test: Check get project (esp. CSP values)

This commit checks to make sure that the hardening headers added are
at least what we expect.  That way, when we update the secure_headers gem,
we will detect reductions or unexpected changes to our hardening mechanisms.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>
