Update CSP to allow external fonts, scripts, and add corresponding test coverage

2026-10-07 23:51:32 +02:00
parent 5ca611c113
commit 5624eead82
4 changed files with 13 additions and 3 deletions
@@ -127,6 +127,16 @@ test("public health checks reach the backend without exposing diagnostics or req
    assert.equal((await request(server.baseUrl, "/admin/diagnostics")).status, 403);
 });

+test("CSP permits the pinned chat markdown script and the app's hosted fonts", async t => {
+    const server = await startTestServer();
+    t.after(() => server.close());
+    const response = await fetch(`${server.baseUrl}/`);
+    const policy = response.headers.get("content-security-policy");
+    assert.match(policy, /style-src[^;]*https:\/\/fonts\.googleapis\.com/);
+    assert.match(policy, /script-src[^;]*https:\/\/cdnjs\.cloudflare\.com/);
+    assert.match(policy, /font-src[^;]*https:\/\/fonts\.gstatic\.com/);
+});
+
 test("personality API keeps prompts private, validates IDs, and enforces chat ownership", async t => {
    const server = await startTestServer();
    t.after(() => server.close());