move_detect/server/tests/CspTest.php

<?php
declare(strict_types=1);
namespace App\Tests;

use App\Http\Response;
use App\Security\Csp;
use PHPUnit\Framework\TestCase;

final class CspTest extends TestCase
{
    protected function setUp(): void { Csp::reset(); }
    protected function tearDown(): void { Csp::reset(); }

    public function testNonceIsStableWithinARequestAndFreshBetweenThem(): void
    {
        // Stable: both inline <script> blocks in layout.php must carry the SAME nonce as the
        // header, or the page breaks. Fresh per request: a reused nonce is no better than
        // 'unsafe-inline' once an attacker can read one.
        $a = Csp::nonce();
        $this->assertSame($a, Csp::nonce());
        Csp::reset();
        $this->assertNotSame($a, Csp::nonce());
    }

    public function testPolicyForbidsInlineAndObjectsAndFraming(): void
    {
        $p = Csp::policy('abc123');
        $this->assertStringContainsString("script-src 'self' 'nonce-abc123'", $p);
        $this->assertStringNotContainsString('unsafe-inline', $p);
        $this->assertStringNotContainsString('unsafe-eval', $p);
        $this->assertStringContainsString("object-src 'none'", $p);
        $this->assertStringContainsString("base-uri 'none'", $p);
        $this->assertStringContainsString("frame-ancestors 'none'", $p);
        // Air-gapped delivery: nothing may be fetched from a third-party origin.
        $this->assertStringNotContainsString('http://', $p);
        $this->assertStringNotContainsString('https://', $p);
    }

    public function testHtmlResponsesCarryTheSecurityHeaders(): void
    {
        $h = Response::text('<p>hi</p>', 200, Csp::headers())->headers();
        $this->assertSame('text/html; charset=utf-8', $h['Content-Type']);
        $this->assertArrayHasKey('Content-Security-Policy', $h);
        $this->assertSame('nosniff', $h['X-Content-Type-Options']);
        $this->assertSame('DENY', $h['X-Frame-Options']);
        $this->assertStringContainsString("'nonce-" . Csp::nonce() . "'", $h['Content-Security-Policy']);
    }

    public function testEveryInlineScriptInTheViewsCarriesANonce(): void
    {
        // The policy is only as good as the markup: one un-nonced inline block and the page
        // silently loses functionality in production while looking fine in a dev server that
        // sends no CSP. No build step means no bundler would catch this either.
        foreach (glob(dirname(__DIR__) . '/src/View/*.php') as $view) {
            $src = (string)file_get_contents($view);
            preg_match_all('/<script(?![^>]*\bsrc=)([^>]*)>/i', $src, $m);
            foreach ($m[1] as $attrs) {
                $this->assertStringContainsString('nonce=', $attrs,
                    basename($view) . ' has an inline <script> with no nonce');
            }
        }
    }
}