gitfor/platform

import { describe, expect, test } from "bun:test";
import { hkdfSha256, utf8 } from "./sync-hash";
import {
  decodeGrant,
  encodeGrant,
  isPublicUserContentPath,
  isUserContentPath,
  USERCONTENT_GRANT_TTL_MS,
  userContentOriginProblem,
  userContentOriginWarning,
} from "./usercontent-policy";

const FORGE = "forge.example.com";
const DOMAINS = { sites: "sites.example.net", editor: "https://editor.example.org" };
const check = (raw: string) => userContentOriginProblem(raw, FORGE, DOMAINS);

describe("userContentOriginProblem", () => {
  test("accepts a separate https registrable domain", () => {
    expect(check("https://usercontent.example.io")).toBeNull();
  });

  test("accepts a localhost dev origin over http", () => {
    expect(check("http://usercontent.localhost:3000")).toBeNull();
  });

  test("rejects the forge host and its case variants", () => {
    expect(check("https://forge.example.com")).toContain("forge host");
    expect(check("https://FORGE.example.com")).toContain("forge host");
  });

  test("warns, without disabling isolation, for origins on the same site as the forge", () => {
    expect(check("https://uc.forge.example.com")).toBeNull();
    expect(userContentOriginWarning("https://uc.forge.example.com", FORGE)).toContain("registrable domain");
    expect(userContentOriginWarning("https://example.com", FORGE)).toContain("registrable domain");
    expect(userContentOriginWarning("https://uc.example.com", FORGE)).toContain("registrable domain");
    expect(userContentOriginWarning("https://usercontent.example.io", FORGE)).toBeNull();
    expect(userContentOriginWarning("http://usercontent.localhost:3000", "localhost")).toBeNull();
  });

  test("rejects hosts under the sites and editor origins", () => {