import { createHash } from 'node:crypto'; import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import { join, resolve } from 'node:path'; import { pathToFileURL } from 'node:url'; import { afterEach, describe, expect, it } from 'vitest'; import { loadProductionInputs } from '@/content/load-production-inputs'; import { createPageMetadata, createStaticHostArtifacts } from '@/content/metadata'; import { render } from '@/entry-server'; import { assemblePrerenderedHtml, type ViteManifest } from '../../scripts/prerender.mjs'; import { verifyArtifactDirectory } from '../../scripts/verify-artifacts.mjs'; import type { ProductionInputs, SiteConfig } from '@/content/types'; const repositoryRoot = process.cwd(); const locations = { contentJson: pathToFileURL(resolve(repositoryRoot, 'content/public/portfolio-content.json')), assetManifestJson: pathToFileURL(resolve(repositoryRoot, 'content/public/asset-manifest.json')), preparedAssetRoot: pathToFileURL(`${resolve(repositoryRoot, 'inputs/prepared-assets')}/`), siteConfigJson: pathToFileURL(resolve(repositoryRoot, 'config/site.preview.json')), }; const manifest: ViteManifest = { 'index.html': { file: 'assets/index-test.js', src: 'index.html', isEntry: true, css: ['assets/index-test.css'], }, }; const template = ` Portfolio
`; const clientJavaScript = 'export {};\n'; const clientStylesheet = 'body { margin: 0; }\n'; const sha256 = (value: string): string => createHash('sha256').update(value).digest('hex'); const wrapAppContents = (html: string, opening: string, closing: string): string => { const appOpening = '
'; const appContentStart = html.indexOf(appOpening) + appOpening.length; const snapshotStart = html.indexOf(''), error: /json-ld/i, }, { name: 'missing infrastructure evidence', mutate: (html: string) => html.replace('id="infrastructure"', 'id="removed-infrastructure"'), error: /section.*infrastructure|visible sections/i, }, { name: 'executable snapshot assignment', mutate: (html: string) => html.replace(''), error: /unexpected executable script/i, }, { name: 'an extra external executable script', mutate: async (_directory: string, html: string) => html.replace('', ''), error: /unexpected executable script|external executable/i, }, { name: 'a final-HTML-authorized extra stylesheet', mutate: async (directory: string, html: string) => { await writeFile(join(directory, 'assets/extra.css'), 'body {}'); return html.replace('', ''); }, error: /trusted.*style|artifact contract|unexpected artifact/i, }, { name: 'a missing trusted module preload', mutate: async (_directory: string, html: string) => html.replace(/]+>\n?/u, ''), error: /trusted.*preload|module preload/i, }, ])('rejects $name instead of trusting final HTML', async ({ mutate, error }) => { const { directory, html, inputs, contract } = await writeValidArtifacts(); await writeFile(join(directory, 'index.html'), await mutate(directory, html)); await expect(verifyArtifactDirectory(directory, inputs, contract)).rejects.toThrow(error); }); it.each([ { name: 'an appended CSP directive', mutate: (headers: string) => `${headers} script-src https://example.test\n`, }, { name: 'an external script-src relaxation', mutate: (headers: string) => headers.replace("script-src 'self'", "script-src 'self' https://example.test"), }, { name: 'a duplicate partial CSP policy', mutate: (headers: string) => `${headers} Content-Security-Policy: default-src 'self'\n`, }, { name: 'commented header impostors', mutate: (headers: string) => headers.split('\n').map((line) => `# ${line}`).join('\n'), }, ])('rejects $name by exact header bytes', async ({ mutate }) => { const { directory, inputs, contract } = await writeValidArtifacts(); const path = join(directory, '_headers.example'); await writeFile(path, mutate(await readFile(path, 'utf8'))); await expect(verifyArtifactDirectory(directory, inputs, contract)).rejects.toThrow(/exact.*headers|headers.*exact/i); }); it('rejects modified redirect example bytes', async () => { const { directory, inputs, contract } = await writeValidArtifacts(); const path = join(directory, '_redirects.example'); await writeFile(path, `${await readFile(path, 'utf8')}# appended\n`); await expect(verifyArtifactDirectory(directory, inputs, contract)).rejects.toThrow(/exact.*redirect|redirect.*exact/i); }); it('rejects modified production sitemap bytes', async () => { const productionSite: SiteConfig = { environment: 'production', canonicalUrl: 'https://portfolio.example.test/', buildId: 'production-test', }; const { directory, inputs, contract } = await writeValidArtifacts(productionSite); const path = join(directory, 'sitemap.xml'); await writeFile(path, `${await readFile(path, 'utf8')}\n`); await expect(verifyArtifactDirectory(directory, inputs, contract)).rejects.toThrow(/exact.*sitemap|sitemap.*exact/i); }); it.each([ { name: 'a hidden application root', mutate: (html: string) => html.replace('
', '