42 lines
1.6 KiB
Go
42 lines
1.6 KiB
Go
package liveview
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestPlayerUsesShortLivedCapabilityAndRestrictiveHeaders(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
store := NewStore()
|
|
now := time.Date(2026, 8, 14, 10, 0, 0, 0, time.UTC)
|
|
store.now = func() time.Time { return now }
|
|
previous := defaultStore
|
|
defaultStore = store
|
|
t.Cleanup(func() { defaultStore = previous })
|
|
store.put(sessionRecord{ID: "view_test", OwnerID: 7, RouteID: "route-1", TargetURL: "http://127.0.0.1:8889/sense_test?controls=true", ExpiresAt: now.Add(sessionTTL)})
|
|
|
|
router := gin.New()
|
|
api := &API{}
|
|
router.GET("/api/v1/liveview/player/:id", api.Player)
|
|
recorder := httptest.NewRecorder()
|
|
router.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/api/v1/liveview/player/view_test", nil))
|
|
if recorder.Code != http.StatusOK || recorder.Header().Get("Cache-Control") != "no-store" || recorder.Header().Get("X-Frame-Options") != "SAMEORIGIN" {
|
|
t.Fatalf("status=%d headers=%v", recorder.Code, recorder.Header())
|
|
}
|
|
if !strings.Contains(recorder.Body.String(), "http://127.0.0.1:8889/sense_test?controls=true") || !strings.Contains(recorder.Header().Get("Content-Security-Policy"), "frame-ancestors 'self'") {
|
|
t.Fatalf("unexpected wrapper response: %s", recorder.Body.String())
|
|
}
|
|
|
|
now = now.Add(sessionTTL)
|
|
expired := httptest.NewRecorder()
|
|
router.ServeHTTP(expired, httptest.NewRequest(http.MethodGet, "/api/v1/liveview/player/view_test", nil))
|
|
if expired.Code != http.StatusGone {
|
|
t.Fatalf("expired capability status=%d", expired.Code)
|
|
}
|
|
}
|