defmodule ToweropsWeb.Plugs.SecurityHeadersTest do
  use ToweropsWeb.ConnCase, async: true

  alias ToweropsWeb.Plugs.SecurityHeaders

  describe "call/2" do
    test "adds security headers to all responses" do
      conn = SecurityHeaders.call(build_conn(), [])

      assert ["default-src 'self'" <> _] = get_resp_header(conn, "content-security-policy")
      assert ["DENY"] = get_resp_header(conn, "x-frame-options")
      assert ["nosniff"] = get_resp_header(conn, "x-content-type-options")
      assert ["strict-origin-when-cross-origin"] = get_resp_header(conn, "referrer-policy")
      assert ["browsing-topics=()"] = get_resp_header(conn, "permissions-policy")

      [csp] = get_resp_header(conn, "content-security-policy")
      assert csp =~ "default-src 'self'"
      assert csp =~ "script-src 'self' 'nonce-"
      assert csp =~ "https://a.w5isp.com"
      refute csp =~ "unsafe-eval"
      assert csp =~ "style-src 'self' 'unsafe-inline' 'unsafe-hashes'"
      assert csp =~ "img-src 'self' data: https:"
      assert csp =~ "font-src 'self' data:"
      assert csp =~ "connect-src 'self' ws: wss: https://a.w5isp.com"
      assert csp =~ "frame-ancestors 'none'"
    end
  end
end