| 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; |
| 3 | |
| 4 | import { pagePolicy } from "./page-headers.ts"; |
| 5 | import { TURNSTILE_SCRIPT, turnstilePassed, turnstileSettings } from "./turnstile.ts"; |
| 6 | |
| 7 | test("Turnstile is on only with both its site key and its secret", () => { |
| 8 | assert.equal(turnstileSettings(undefined, undefined), null); |
| 9 | assert.equal(turnstileSettings("0x4AAA", ""), null); |
| 10 | assert.equal(turnstileSettings("", "0x4BBB"), null); |
| 11 | assert.deepEqual(turnstileSettings(" 0x4AAA ", "0x4BBB"), { siteKey: "0x4AAA", secret: "0x4BBB" }); |
| 12 | }); |
| 13 | |
| 14 | test("only Cloudflare's success counts as a pass", () => { |
| 15 | assert.equal(turnstilePassed({ success: true }), true); |
| 16 | assert.equal(turnstilePassed({ success: false, "error-codes": ["invalid-input-response"] }), false); |
| 17 | assert.equal(turnstilePassed({ success: "true" }), false); |
| 18 | assert.equal(turnstilePassed(null), false); |
| 19 | }); |
| 20 | |
| 21 | test("the page's policy lets the widget's script and frame load, and nothing else framed", () => { |
| 22 | const policy = pagePolicy("n0nce"); |
| 23 | const origin = new URL(TURNSTILE_SCRIPT).origin; |
| 24 | assert.match(policy, new RegExp(`script-src [^;]*${origin.replace(/\./g, "\\.")}`)); |
| 25 | assert.match(policy, new RegExp(`frame-src ${origin.replace(/\./g, "\\.")};`)); |
| 26 | assert.match(policy, /frame-ancestors 'none'/); |
| 27 | }); |