pixa/internal/middleware/middleware_internal_test.go

package middleware

import (
	"log/slog"
	"net/http"
	"net/http/httptest"
	"testing"

	"sneak.berlin/go/pixa/internal/config"
)

func TestSecurityHeaders(t *testing.T) {
	t.Parallel()

	// Create middleware instance
	cfg := &config.Config{}
	mw := &Middleware{
		log:    slog.Default(),
		config: cfg,
	}

	// Create a test handler
	testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	// Wrap with security headers middleware
	handler := mw.SecurityHeaders()(testHandler)

	// Make a test request
	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/test", nil)
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	// Check security headers
	tests := []struct {
		header string
		want   string
	}{
		{"X-Content-Type-Options", "nosniff"},
		{"X-Frame-Options", "DENY"},
		{"Referrer-Policy", "strict-origin-when-cross-origin"},
		{"X-XSS-Protection", "0"},
	}

	for _, tt := range tests {
		t.Run(tt.header, func(t *testing.T) {
			t.Parallel()

			got := rec.Header().Get(tt.header)
			if got != tt.want {
				t.Errorf("%s = %q, want %q", tt.header, got, tt.want)
			}
		})
	}
}

func TestSecurityHeaders_PolicyHeaders(t *testing.T) {
	t.Parallel()

	cfg := &config.Config{}
	mw := &Middleware{
		log:    slog.Default(),
		config: cfg,
	}

	testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	handler := mw.SecurityHeaders()(testHandler)

	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/test", nil)
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	tests := []struct {
		header string
		want   string
	}{
		{"Strict-Transport-Security", "max-age=31536000; includeSubDomains"},
		{
			"Content-Security-Policy",
			"default-src 'self'; " +
				"script-src 'self' 'unsafe-inline'; " +
				"style-src 'self' 'unsafe-inline'; " +
				"object-src 'none'; " +
				"base-uri 'self'; " +
				"form-action 'self'; " +
				"frame-ancestors 'none'",
		},
		{
			"Permissions-Policy",
			"accelerometer=(), autoplay=(), camera=(), " +
				"display-capture=(), geolocation=(), gyroscope=(), " +
				"magnetometer=(), microphone=(), payment=(), usb=()",
		},
	}

	for _, tt := range tests {
		t.Run(tt.header, func(t *testing.T) {
			t.Parallel()

			got := rec.Header().Get(tt.header)
			if got != tt.want {
				t.Errorf("%s = %q, want %q", tt.header, got, tt.want)
			}
		})
	}
}

func TestSecurityHeaders_PreservesExistingHeaders(t *testing.T) {
	t.Parallel()

	cfg := &config.Config{}
	mw := &Middleware{
		log:    slog.Default(),
		config: cfg,
	}

	// Handler that sets its own headers
	testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("X-Custom-Header", "custom-value")
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusOK)
	})

	handler := mw.SecurityHeaders()(testHandler)

	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/test", nil)
	rec := httptest.NewRecorder()

	handler.ServeHTTP(rec, req)

	// Security headers should be present
	if rec.Header().Get("X-Content-Type-Options") != "nosniff" {
		t.Error("X-Content-Type-Options not set")
	}

	// Custom headers should still be there
	if rec.Header().Get("X-Custom-Header") != "custom-value" {
		t.Error("Custom header was overwritten")
	}

	if rec.Header().Get("Content-Type") != "application/json" {
		t.Error("Content-Type was overwritten")
	}
}