import assert from 'node:assert/strict' import test from 'node:test' import { createCspAllowlistCandidates, isCspAllowlistOriginCandidate, normalizeCspSourceDirective } from '../lib/csp-policy-suggestions.js' test('CSP 세부 지시어는 강제 정책 후보 지시어로 묶는다', () => { assert.equal(normalizeCspSourceDirective('script-src-elem'), 'script-src') assert.equal(normalizeCspSourceDirective('style-src-attr'), 'style-src') assert.equal(normalizeCspSourceDirective('child-src'), 'frame-src') assert.equal(normalizeCspSourceDirective('base-uri'), '') }) test('CSP 허용 후보 origin은 http와 https origin만 사용한다', () => { assert.equal(isCspAllowlistOriginCandidate('https://cdn.example.com'), true) assert.equal(isCspAllowlistOriginCandidate('http://localhost:43080'), true) assert.equal(isCspAllowlistOriginCandidate('inline'), false) assert.equal(isCspAllowlistOriginCandidate('data:'), false) assert.equal(isCspAllowlistOriginCandidate('https://cdn.example.com/path/file.js'), false) }) test('CSP 허용 후보는 지시어와 origin별로 집계한다', () => { const candidates = createCspAllowlistCandidates([ { effectiveDirective: 'script-src-elem', blockedOrigin: 'https://cdn.example.com', violationCount: 2, lastSeenAt: '2026-07-29T01:00:00.000Z' }, { effectiveDirective: 'script-src', blockedOrigin: 'https://cdn.example.com', violationCount: 3, lastSeenAt: '2026-07-29T02:00:00.000Z' }, { effectiveDirective: 'img-src', blockedOrigin: 'data:', violationCount: 8, lastSeenAt: '2026-07-29T03:00:00.000Z' }, { effectiveDirective: 'frame-src', blockedOrigin: 'https://player.example.com', violationCount: 1, lastSeenAt: '2026-07-29T04:00:00.000Z' } ]) assert.deepEqual(candidates, [ { sourceDirective: 'script-src', blockedOrigin: 'https://cdn.example.com', violationCount: 5, lastSeenAt: '2026-07-29T02:00:00.000Z' }, { sourceDirective: 'frame-src', blockedOrigin: 'https://player.example.com', violationCount: 1, lastSeenAt: '2026-07-29T04:00:00.000Z' } ]) })