import { describe, expect, it } from "vitest";
import { proxy } from "./proxy";

function csp(): string {
  return proxy().headers.get("Content-Security-Policy") ?? "";
}

describe("proxy security headers", () => {
  it("lets the page play its own voice recordings (blob:) and nothing broader", () => {
    const directives = csp().split(";").map((part) => part.trim());

    expect(directives).toContain("media-src 'self' blob:");
    expect(directives.filter((part) => part.startsWith("media-src"))).toHaveLength(1);
  });

  it("keeps the default of the same origin only", () => {
    expect(csp()).toContain("default-src 'self'");
  });
});