test: Testabdeckung fuer CSRF-Schutz, Entra-ID-SSO und DHL-Client

Keine der in dieser Session neu hinzugefuegten sicherheitskritischen
Module (lib/csrf.ts, lib/entra.ts, lib/dhl.ts) hatte bisher Tests.

- csrf.test.ts: Same-Origin-Erkennung, Ablehnung gefaelschter
  Cross-Origin-Requests, tolerantes Verhalten bei fehlendem/kaputtem
  Origin-Header.
- entra.test.ts: PKCE-Paar-Erzeugung (RFC 7636), Authorize-URL-Aufbau,
  Extraktion des verifizierten E-Mail-Claims (nie ein unplausibles
  Feld raten).
- dhl.test.ts: Adress-Mapping (Strasse/Hausnummer-Trennung,
  ISO2->ISO3-Laendercode), Fehlerbehandlung bei nicht unterstuetztem
  Land, DHL-Validierungsfehlern und HTTP-Fehlern, statt einen falschen
  Erfolg vorzutaeuschen.

Alle 118 Tests (13 Dateien) gruen, tsc --noEmit clean.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

src/lib/csrf.test.ts

@@ -0,0 +1,40 @@
+import { describe, test, expect } from "vitest";
+import { isTrustedOrigin } from "./csrf";
+
+function makeRequest(url: string, origin?: string): Request {
+  const headers = new Headers();
+  if (origin !== undefined) headers.set("origin", origin);
+  return new Request(url, { method: "POST", headers });
+}
+
+describe("isTrustedOrigin", () => {
+  test("accepts a same-origin request", () => {
+    const request = makeRequest("https://wabenhain.com/api/checkout", "https://wabenhain.com");
+    expect(isTrustedOrigin(request)).toBe(true);
+  });
+
+  test("accepts a same-origin request even with an explicit default port in the URL", () => {
+    const request = makeRequest("https://wabenhain.com:443/api/checkout", "https://wabenhain.com");
+    expect(isTrustedOrigin(request)).toBe(true);
+  });
+
+  test("rejects a cross-origin request (forged CSRF attempt)", () => {
+    const request = makeRequest("https://wabenhain.com/api/checkout", "https://attacker.example");
+    expect(isTrustedOrigin(request)).toBe(false);
+  });
+
+  test("rejects a cross-origin request even from a similarly named host", () => {
+    const request = makeRequest("https://wabenhain.com/api/checkout", "https://wabenhain.com.attacker.example");
+    expect(isTrustedOrigin(request)).toBe(false);
+  });
+
+  test("rejects a malformed Origin header instead of throwing", () => {
+    const request = makeRequest("https://wabenhain.com/api/checkout", "not-a-valid-url");
+    expect(isTrustedOrigin(request)).toBe(false);
+  });
+
+  test("allows a request with no Origin header (e.g. server-to-server calls)", () => {
+    const request = makeRequest("https://wabenhain.com/api/checkout");
+    expect(isTrustedOrigin(request)).toBe(true);
+  });
+});