CSP 허용 후보 표시 추가

tests/csp-policy-suggestions.test.js

@@ -0,0 +1,66 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import {
+  createCspAllowlistCandidates,
+  isCspAllowlistOriginCandidate,
+  normalizeCspSourceDirective
+} from '../lib/csp-policy-suggestions.js'
+
+test('CSP 세부 지시어는 강제 정책 후보 지시어로 묶는다', () => {
+  assert.equal(normalizeCspSourceDirective('script-src-elem'), 'script-src')
+  assert.equal(normalizeCspSourceDirective('style-src-attr'), 'style-src')
+  assert.equal(normalizeCspSourceDirective('child-src'), 'frame-src')
+  assert.equal(normalizeCspSourceDirective('base-uri'), '')
+})
+
+test('CSP 허용 후보 origin은 http와 https origin만 사용한다', () => {
+  assert.equal(isCspAllowlistOriginCandidate('https://cdn.example.com'), true)
+  assert.equal(isCspAllowlistOriginCandidate('http://localhost:43080'), true)
+  assert.equal(isCspAllowlistOriginCandidate('inline'), false)
+  assert.equal(isCspAllowlistOriginCandidate('data:'), false)
+  assert.equal(isCspAllowlistOriginCandidate('https://cdn.example.com/path/file.js'), false)
+})
+
+test('CSP 허용 후보는 지시어와 origin별로 집계한다', () => {
+  const candidates = createCspAllowlistCandidates([
+    {
+      effectiveDirective: 'script-src-elem',
+      blockedOrigin: 'https://cdn.example.com',
+      violationCount: 2,
+      lastSeenAt: '2026-07-29T01:00:00.000Z'
+    },
+    {
+      effectiveDirective: 'script-src',
+      blockedOrigin: 'https://cdn.example.com',
+      violationCount: 3,
+      lastSeenAt: '2026-07-29T02:00:00.000Z'
+    },
+    {
+      effectiveDirective: 'img-src',
+      blockedOrigin: 'data:',
+      violationCount: 8,
+      lastSeenAt: '2026-07-29T03:00:00.000Z'
+    },
+    {
+      effectiveDirective: 'frame-src',
+      blockedOrigin: 'https://player.example.com',
+      violationCount: 1,
+      lastSeenAt: '2026-07-29T04:00:00.000Z'
+    }
+  ])
+
+  assert.deepEqual(candidates, [
+    {
+      sourceDirective: 'script-src',
+      blockedOrigin: 'https://cdn.example.com',
+      violationCount: 5,
+      lastSeenAt: '2026-07-29T02:00:00.000Z'
+    },
+    {
+      sourceDirective: 'frame-src',
+      blockedOrigin: 'https://player.example.com',
+      violationCount: 1,
+      lastSeenAt: '2026-07-29T04:00:00.000Z'
+    }
+  ])
+})