Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Merge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them. | 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; | |
| 3 | ||
| 4 | import { pagePolicy } from "./page-headers.ts"; | |
| 5 | import { TURNSTILE_SCRIPT, turnstilePassed, turnstileSettings } from "./turnstile.ts"; | |
| 6 | ||
| 7 | test("Turnstile is on only with both its site key and its secret", () => { | |
| 8 | assert.equal(turnstileSettings(undefined, undefined), null); | |
| 9 | assert.equal(turnstileSettings("0x4AAA", ""), null); | |
| 10 | assert.equal(turnstileSettings("", "0x4BBB"), null); | |
| 11 | assert.deepEqual(turnstileSettings(" 0x4AAA ", "0x4BBB"), { siteKey: "0x4AAA", secret: "0x4BBB" }); | |
| 12 | }); | |
| 13 | ||
| 14 | test("only Cloudflare's success counts as a pass", () => { | |
| 15 | assert.equal(turnstilePassed({ success: true }), true); | |
| 16 | assert.equal(turnstilePassed({ success: false, "error-codes": ["invalid-input-response"] }), false); | |
| 17 | assert.equal(turnstilePassed({ success: "true" }), false); | |
| 18 | assert.equal(turnstilePassed(null), false); | |
| 19 | }); | |
| 20 | ||
| 21 | test("the page's policy lets the widget's script and frame load, and nothing else framed", () => { | |
| 22 | const policy = pagePolicy("n0nce"); | |
| 23 | const origin = new URL(TURNSTILE_SCRIPT).origin; | |
| 24 | assert.match(policy, new RegExp(`script-src [^;]*${origin.replace(/\./g, "\\.")}`)); | |
| 25 | assert.match(policy, new RegExp(`frame-src ${origin.replace(/\./g, "\\.")};`)); | |
| 26 | assert.match(policy, /frame-ancestors 'none'/); | |
| 27 | }); |
This file's history is long; its oldest lines are credited to the oldest commit read.