Danijel Martinek
96274ba856
Adds framework-agnostic security headers module to core-shared/security: - SecurityHeadersConfig + CspMode types - generateNonce() using crypto.randomBytes(16) - buildSecurityHeaders() emitting all six headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP) with prod (strict-dynamic + nonce threading) and dev (unsafe-inline/eval + ws/localhost) CSP modes; URL validation throwing InvalidSecurityHeadersConfig on malformed allowedConnect/Img/FontOrigins - Full unit test suite (24 tests, 100% coverage on runtime files) - Exported from core-shared barrel and ./security subpath Blocks story 07 (framework adapters) and stories 08-09 (app wiring). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
20 lines
540 B
TypeScript
20 lines
540 B
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { generateNonce } from "@/security/nonce";
|
|
|
|
describe("generateNonce", () => {
|
|
it("returns a string", () => {
|
|
expect(typeof generateNonce()).toBe("string");
|
|
});
|
|
|
|
it("returns base64-encoded 16-byte value", () => {
|
|
const nonce = generateNonce();
|
|
expect(Buffer.from(nonce, "base64").length).toBe(16);
|
|
});
|
|
|
|
it("returns different values on successive calls", () => {
|
|
const n1 = generateNonce();
|
|
const n2 = generateNonce();
|
|
expect(n1).not.toBe(n2);
|
|
});
|
|
});
|