import { describe, expect, it } from "vitest";
import applicationHtml from "../../index.html?raw";
import homepageHtml from "../../public/homepage.html?raw";

const CSP = "script-src 'self'";

describe("frontend security policy", () => {
  it.each([
    ["application", applicationHtml],
    ["homepage", homepageHtml],
  ])("protects the %s document from inline script execution", (_, html) => {
    expect(html).toContain("http-equiv=\"Content-Security-Policy\"");
    expect(html).toContain(CSP);
    expect(html).not.toMatch(/<script(?![^>]*\bsrc=)[^>]*>/i);
  });
});