improvements

src/tests/app.rs

@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2026 Mateusz Gruszczyński @linuxiarz.pl
+ * Source-Available Code / Dual-Licensed.
+ *
+ * Free for non-commercial and evaluation use under terms of BSL/GPLv3.
+ * Commercial or production use requires a valid paid license.
+ * See LICENSE file in repository root for details.
+ */
+
+use super::{ResponseHeaderPolicy, apply_response_headers, response_header_policy};
+use axum::http::{HeaderMap, HeaderValue, header};
+
+#[test]
+fn classifies_assets_and_icons_as_static_assets() {
+    for path in [
+        "/assets/app.js",
+        "/assets",
+        "/favicon.ico",
+        "/icons/favicon.svg",
+        "/icons/missing.svg",
+    ] {
+        assert_eq!(
+            response_header_policy(path),
+            ResponseHeaderPolicy::StaticAsset
+        );
+    }
+}
+
+#[test]
+fn classifies_file_routes_as_files() {
+    for path in ["/f", "/f/token/image.png"] {
+        assert_eq!(response_header_policy(path), ResponseHeaderPolicy::File);
+    }
+}
+
+#[test]
+fn classifies_other_routes_as_application() {
+    for path in [
+        "/",
+        "/api/auth/me",
+        "/static/missing.css",
+        "/files/legacy/image.png",
+        "/unknown",
+    ] {
+        assert_eq!(
+            response_header_policy(path),
+            ResponseHeaderPolicy::Application
+        );
+    }
+}
+
+#[test]
+fn static_asset_policy_only_adds_nosniff() {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("public, max-age=3600"),
+    );
+
+    apply_response_headers(ResponseHeaderPolicy::StaticAsset, &mut headers);
+
+    assert_eq!(headers.len(), 2);
+    assert_eq!(headers[header::X_CONTENT_TYPE_OPTIONS], "nosniff");
+    assert!(!headers.contains_key("x-frame-options"));
+    assert!(!headers.contains_key("cross-origin-opener-policy"));
+    assert!(!headers.contains_key("cross-origin-resource-policy"));
+    assert!(!headers.contains_key("referrer-policy"));
+    assert!(!headers.contains_key("permissions-policy"));
+}
+
+#[test]
+fn file_policy_keeps_file_headers_without_document_policies() {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        "content-security-policy",
+        HeaderValue::from_static("default-src 'none'; sandbox"),
+    );
+    headers.insert(
+        header::CONTENT_DISPOSITION,
+        HeaderValue::from_static("attachment; filename=\"manual.pdf\""),
+    );
+
+    apply_response_headers(ResponseHeaderPolicy::File, &mut headers);
+
+    assert_eq!(headers[header::X_CONTENT_TYPE_OPTIONS], "nosniff");
+    assert_eq!(
+        headers["content-security-policy"],
+        "default-src 'none'; sandbox"
+    );
+    assert!(headers.contains_key(header::CONTENT_DISPOSITION));
+    assert!(!headers.contains_key("x-frame-options"));
+    assert!(!headers.contains_key("cross-origin-opener-policy"));
+    assert!(!headers.contains_key("cross-origin-resource-policy"));
+    assert!(!headers.contains_key("referrer-policy"));
+    assert!(!headers.contains_key("permissions-policy"));
+}
+
+#[test]
+fn application_policy_preserves_handler_headers() {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        "content-security-policy",
+        HeaderValue::from_static("default-src 'none'; sandbox"),
+    );
+
+    apply_response_headers(ResponseHeaderPolicy::Application, &mut headers);
+
+    assert_eq!(
+        headers["content-security-policy"],
+        "default-src 'none'; sandbox"
+    );
+    assert_eq!(headers["x-frame-options"], "DENY");
+    assert_eq!(headers["cross-origin-opener-policy"], "same-origin");
+    assert_eq!(headers["cross-origin-resource-policy"], "same-origin");
+    assert_eq!(headers[header::X_CONTENT_TYPE_OPTIONS], "nosniff");
+    assert_eq!(
+        headers["referrer-policy"],
+        "strict-origin-when-cross-origin"
+    );
+    assert!(headers.contains_key("permissions-policy"));
+}