runicgateway.com/test/headers.test.mjs

/**
 * The headers the built site actually sends. PLAN.md §6 / D48, phase 10.
 *
 * ---------------------------------------------------------------------------------------
 * WHY THIS IS A TEST AND NOT A CHECK SCRIPT
 * ---------------------------------------------------------------------------------------
 * `scripts/checkCsp.mjs` reads `dist/_headers.json` and proves the build computed the right
 * policy for every route. That is necessary and it is not sufficient, because the defect
 * this file exists for happened entirely *after* the build was correct: `@astrojs/node`
 * matched a request to a policy with `pathname.includes(...)`, a substring test, and served
 * `/modules/` the policy built for `/docs/modules/building-a-module`. Every file on disk was
 * right. The bytes on the wire were not.
 *
 * Nothing that reads `dist/` can see that. The only way to know what a reader receives is
 * to start the server and ask it, so this starts `scripts/serve.mjs` on an ephemeral port
 * and reads the responses.
 *
 * The symptom is worth restating, because it is what makes this worth a test rather than a
 * comment: a page served another page's hash list renders with its own stylesheet REFUSED.
 * `/modules/` and `/architecture/` were shipping unstyled sections, and the only trace was
 * a console message. The homepage looked perfect throughout — it happened to share a hash
 * with the 404 page it was being given.
 *
 * ---------------------------------------------------------------------------------------
 * IT NEEDS A BUILD
 * ---------------------------------------------------------------------------------------
 * `dist/` is an input here, so this file is NOT in `npm test` — that runs before the build,
 * both locally and in CI. It is `npm run test:served`, which `npm run verify` runs after
 * `npm run build`. With no build present it skips rather than fails, so that a developer
 * running the whole file by hand gets an explanation instead of a stack trace.
 */

import assert from 'node:assert/strict';
import { spawn } from 'node:child_process';
import { createHash } from 'node:crypto';
import fs from 'node:fs';
import path from 'node:path';
import { after, before, describe, it } from 'node:test';
import { fileURLToPath } from 'node:url';

const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
const built = fs.existsSync(path.join(root, 'dist', 'server', 'entry.mjs'));

const PORT = 41732;
const base = `http://127.0.0.1:${PORT}`;

let server;

/** Wait for the port to answer rather than sleeping a guessed number of milliseconds. */
async function waitForServer(timeoutMs = 30000) {
  const deadline = Date.now() + timeoutMs;
  while (Date.now() < deadline) {
    try {
      await fetch(base + '/', { signal: AbortSignal.timeout(1000) });
      return;
    } catch {
      await new Promise((resolve) => setTimeout(resolve, 200));
    }
  }
  throw new Error(`serve.mjs did not answer on ${base} within ${timeoutMs}ms`);
}

describe('the headers the server sends', { skip: built ? false : 'no build in dist/ — run npm run build first' }, () => {
  before(async () => {
    server = spawn(process.execPath, [path.join(root, 'scripts', 'serve.mjs')], {
      cwd: root,
      env: { ...process.env, PORT: String(PORT), HOST: '127.0.0.1' },
      stdio: 'ignore',
    });
    await waitForServer();
  });

  after(() => server?.kill());

  const cspOf = async (route) => {
    const res = await fetch(base + route);
    assert.equal(res.status, route === '/404' ? 404 : 200, `${route} status`);
    const csp = res.headers.get('content-security-policy');
    assert.ok(csp, `${route} has no Content-Security-Policy header`);
    return csp;
  };

  it('gives each prerendered route its OWN policy, not a substring match', async () => {
    // The exact pair the upstream bug confused: one is a substring of the other.
    const marketing = await cspOf('/modules/');
    const docs = await cspOf('/docs/modules/building-a-module/');
    assert.notEqual(marketing, docs, '/modules/ was served the docs page\'s policy');

    // And the homepage, which matched whichever record came first in the file.
    const home = await cspOf('/');
    const notFound = await cspOf('/404');
    assert.notEqual(home, notFound, '/ was served the 404 page\'s policy');
  });

  it("covers a page's own inline styles with hashes in the policy it is served", async () => {
    for (const route of ['/', '/modules/', '/architecture/', '/docs/']) {
      const csp = await cspOf(route);
      const html = await (await fetch(base + route)).text();

      let counted = 0;
      for (const [, body] of html.matchAll(/<style[^>]*>([\s\S]*?)<\/style>/g)) {
        if (body.trim() === '') continue;
        counted++;
        const hash = `sha256-${createHash('sha256').update(body, 'utf8').digest('base64')}`;
        assert.ok(csp.includes(hash), `${route}: an inline <style> is not hashed in its own policy`);
      }
      assert.ok(counted > 0, `${route}: expected at least one inline style to check`);
    }
  });

  it('refuses framing everywhere, including the routes that render per request', async () => {
    for (const route of ['/', '/docs/', '/beta/', '/brand/theme.css']) {
      const res = await fetch(base + route);
      const csp = res.headers.get('content-security-policy') ?? '';
      assert.match(csp, /frame-ancestors 'none'/, `${route} can be framed`);
    }
  });

  it('sends the non-CSP security headers on every response', async () => {
    for (const route of ['/', '/docs/', '/beta/']) {
      const res = await fetch(base + route);
      assert.equal(res.headers.get('x-content-type-options'), 'nosniff', route);
      assert.equal(res.headers.get('x-frame-options'), 'DENY', route);
      assert.match(res.headers.get('referrer-policy') ?? '', /strict-origin/, route);
      assert.match(res.headers.get('permissions-policy') ?? '', /camera=\(\)/, route);
    }
  });

  it("never falls back to 'unsafe-inline' for scripts", async () => {
    for (const route of ['/', '/docs/', '/beta/']) {
      const csp = (await fetch(base + route)).headers.get('content-security-policy') ?? '';
      const scriptSrc = /script-src ([^;]*)/.exec(csp)?.[1] ?? '';
      assert.ok(!scriptSrc.includes("'unsafe-inline'"), `${route} script-src allows unsafe-inline`);
    }
  });

  /**
   * D56, phase 12. The signup POST behind a TLS-terminating proxy.
   *
   * `@astrojs/node` derives the request URL's protocol from `req.socket.encrypted` and
   * never reads `x-forwarded-proto`, so a container reached over plaintext by a proxy
   * computes `http://<host>` while the browser is sending `Origin: https://<host>`. Astro's
   * CSRF middleware compares those two for equality, so the answer is 403 — for every
   * visitor, on the only page that accepts a POST.
   *
   * This is the shape of a request as a proxy actually delivers it, and it belongs in this
   * file rather than in `npm test` for the same reason everything else here does: the build
   * was already correct, the store was already correct, and the failure existed only in the
   * bytes on the wire. `serve.mjs` normalises both forwarded headers; these assertions are
   * what stop that being deleted as unnecessary.
   *
   * It stops at the origin check deliberately — a signup that reached the store would write
   * a row into whatever `data/` the developer running the suite happens to have.
   */
  it('accepts a form POST forwarded by a proxy that terminated TLS', async () => {
    const host = 'runicgateway.com';
    const res = await fetch(base + '/beta/', {
      method: 'POST',
      redirect: 'manual',
      headers: {
        host,
        origin: `https://${host}`,
        'x-forwarded-proto': 'https',
        'x-forwarded-host': host,
        'x-forwarded-for': '203.0.113.7',
        'content-type': 'application/x-www-form-urlencoded',
      },
      // No form token, so the signup refuses it — but it must refuse it as a stale form,
      // rendering the page, rather than as a cross-site request.
      body: 'email=&consent=&ts=',
    });

    assert.notEqual(res.status, 403, 'the proxy-shaped POST was refused as cross-site (D56)');
    assert.equal(res.status, 200);
  });

  it('still refuses a genuinely cross-site POST', async () => {
    const res = await fetch(base + '/beta/', {
      method: 'POST',
      redirect: 'manual',
      headers: {
        host: 'runicgateway.com',
        origin: 'https://not-us.example.com',
        'x-forwarded-proto': 'https',
        'x-forwarded-host': 'runicgateway.com',
        'content-type': 'application/x-www-form-urlencoded',
      },
      body: 'email=&consent=&ts=',
    });

    assert.equal(res.status, 403, 'the forwarded-header fix weakened the CSRF check');
  });
});