v0.2.3

src/routes/tests.rs

@@ -277,6 +277,118 @@ async fn api_health_works_with_static_fallback() {
     assert_eq!(json["status"], "ok");
 }
 
+#[tokio::test]
+async fn disabled_optional_features_are_not_registered() {
+    let dir = setup_static_dir();
+    let mut config = (*test_config(dir.path().to_str().unwrap())).clone();
+    config.sieve_enabled = false;
+    config.diagnostics_enabled = false;
+    let app = create_router(
+        Arc::new(config),
+        test_store(),
+        test_imap_client(),
+        test_smtp_client(),
+        test_search_engine("/tmp/oxi-test"),
+        test_event_bus(),
+        test_idle_manager(),
+    );
+
+    for uri in ["/api/sieve/status", "/api/diagnostics/imap"] {
+        let response = app
+            .clone()
+            .oneshot(Request::builder().uri(uri).body(Body::empty()).unwrap())
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{uri}");
+    }
+}
+
+#[tokio::test]
+async fn auth_policy_exposes_optional_feature_switches() {
+    let dir = setup_static_dir();
+    let mut config = (*test_config(dir.path().to_str().unwrap())).clone();
+    config.sieve_enabled = false;
+    config.diagnostics_enabled = false;
+    config.about_enabled = false;
+    let app = create_router(
+        Arc::new(config),
+        test_store(),
+        test_imap_client(),
+        test_smtp_client(),
+        test_search_engine("/tmp/oxi-test"),
+        test_event_bus(),
+        test_idle_manager(),
+    );
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/auth/policy")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = response.into_body().collect().await.unwrap().to_bytes();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(json["sieveEnabled"], false);
+    assert_eq!(json["diagnosticsEnabled"], false);
+    assert_eq!(json["aboutEnabled"], false);
+}
+
+#[tokio::test]
+async fn security_headers_are_opt_in() {
+    let dir = setup_static_dir();
+    let app = create_router(
+        test_config(dir.path().to_str().unwrap()),
+        test_store(),
+        test_imap_client(),
+        test_smtp_client(),
+        test_search_engine("/tmp/oxi-test"),
+        test_event_bus(),
+        test_idle_manager(),
+    );
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/health")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert!(response.headers().get("content-security-policy").is_none());
+
+    let mut config = (*test_config(dir.path().to_str().unwrap())).clone();
+    config.security_headers_enabled = true;
+    let app = create_router(
+        Arc::new(config),
+        test_store(),
+        test_imap_client(),
+        test_smtp_client(),
+        test_search_engine("/tmp/oxi-test"),
+        test_event_bus(),
+        test_idle_manager(),
+    );
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/health")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.headers()["x-frame-options"], "DENY");
+    assert!(
+        response.headers()["content-security-policy"]
+            .to_str()
+            .unwrap()
+            .contains("default-src 'self'")
+    );
+}
+
 #[tokio::test]
 async fn root_serves_embedded_rustbox_ui() {
     let dir = setup_static_dir();