Fix tests

jlledom · jlledom · commit a3f1e2e4dc87 · 2025-12-09T10:53:22.000+01:00
diff --git a/test/integration/developer_portal/content_security_policy_test.rb b/test/integration/developer_portal/content_security_policy_test.rb
@@ -3,67 +3,76 @@
 require 'test_helper'
 
 class DeveloperPortal::ContentSecurityPolicyTest < ActionDispatch::IntegrationTest
-  def setup
-    @provider = FactoryBot.create(:provider_account)
-    @buyer = FactoryBot.create(:buyer_account, provider_account: @provider)
-    login_buyer @buyer
-  end
 
-  test 'applies CSP header to developer portal HTML responses' do
-    get '/admin'
+  class TestController < ApplicationController
+    def html
+      render html: '<html><body>Test</body></html>'.html_safe
+    end
 
-    assert_response :success
-    assert_not_nil response.headers['Content-Security-Policy']
+    def json
+      render json: { test: true }
+    end
 
-    csp_header = response.headers['Content-Security-Policy']
-    # Verify permissive policy for developer portal
-    assert_includes csp_header, "*"
-    assert_includes csp_header, "'unsafe-eval'"
+    def not_modified
+      head :not_modified
+    end
   end
 
-  test 'CSP header is applied to authenticated pages' do
-    get '/admin/account/edit'
-
-    assert_response :success
-    assert_not_nil response.headers['Content-Security-Policy']
+  def with_test_routes
+    DeveloperPortal::Engine.routes.draw do
+      get '/test/csp/html' => 'content_security_policy_test/test#html'
+      get '/test/csp/json' => 'content_security_policy_test/test#json'
+      get '/test/csp/304' => 'content_security_policy_test/test#not_modified'
+    end
+    yield
+  ensure
+    Rails.application.routes_reloader.reload!
   end
 
-  test 'middleware handles 304 Not Modified responses correctly' do
-    # The middleware has special handling for 304 responses to avoid
-    # nonce mismatches with cached content. This test verifies the middleware
-    # returns early for 304 responses.
-
-    # Make a request
-    get '/admin'
-    first_csp = response.headers['Content-Security-Policy']
-
-    assert_response :success
-    assert_not_nil first_csp
-
-    # NOTE: The 304 handling is tested at the middleware level in unit tests.
-    # Integration tests can't easily simulate the exact conditions where
-    # Rails returns a 304 before middleware runs.
+  def setup
+    @provider = FactoryBot.create(:provider_account)
+    @buyer = FactoryBot.create(:buyer_account, provider_account: @provider)
+    host! @provider.internal_domain
   end
 
   test 'includes configured directives from YAML' do
-    get '/admin'
-
-    assert_response :success
-    csp_header = response.headers['Content-Security-Policy']
-
-    # Verify it contains the permissive default_src directive from developer_portal_policy
-    assert_includes csp_header, "default-src"
-    assert_includes csp_header, "*"
-    assert_includes csp_header, "'unsafe-eval'"
-    assert_includes csp_header, "'unsafe-inline'"
+    with_test_routes do
+      get '/test/csp/html'
+
+      assert_response :success
+      csp_header = response.headers['Content-Security-Policy']
+
+      # Verify it contains the permissive default_src directive from developer_portal_policy
+      assert_includes csp_header, "default-src"
+      assert_includes csp_header, "*"
+      assert_includes csp_header, "'unsafe-eval'"
+      assert_includes csp_header, "'unsafe-inline'"
+    end
   end
 
   test 'does not apply CSP headers to non-HTML responses' do
-    # Test JSON response
-    get '/admin.json'
+    with_test_routes do
+      get '/test/csp/json', params: { format: :json }
+
+      assert_response :success
+      # JSON responses should not have CSP headers
+      assert_nil response.headers['Content-Security-Policy']
+      assert_nil response.headers['Content-Security-Policy-Report-Only']
+    end
+  end
+
+  test 'middleware handles 304 Not Modified responses correctly' do
+    # The middleware has special handling for 304 responses to avoid
+    # nonce mismatches with cached content. This test verifies the middleware
+    # returns early for 304 responses and does not add CSP headers.
+
+    with_test_routes do
+      get '/test/csp/304'
 
-    # JSON responses should not have CSP headers
-    assert_nil response.headers['Content-Security-Policy']
-    assert_nil response.headers['Content-Security-Policy-Report-Only']
+      assert_response :not_modified
+      # CSP middleware should not add headers to 304 responses
+      assert_nil response.headers['Content-Security-Policy']
+      assert_nil response.headers['Content-Security-Policy-Report-Only']
+    end
   end
 end
