feat: release design system engine, studio and component contracts

packages/core/test/route-csp.test.ts

@@ -0,0 +1,43 @@
+import { expect, test } from "bun:test";
+import { withSecurityHeaders } from "../src/headers.ts";
+const request = new Request("https://app.example.test/");
+const policy =
+  "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors https://customer.example.test; sandbox";
+test("route CSP does not override the default without explicit application opt-in", () => {
+  const response = withSecurityHeaders(
+    request,
+    new Response("static", { headers: { "content-security-policy": policy } }),
+    "production",
+  );
+  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
+  expect(response.headers.get("x-frame-options")).toBe("SAMEORIGIN");
+});
+test("trusted static routes retain strict CSP and explicit cross-origin framing when enabled", () => {
+  const response = withSecurityHeaders(
+    request,
+    new Response("static", { headers: { "content-security-policy": policy } }),
+    "production",
+    { routeContentSecurityPolicy: true },
+  );
+  expect(response.headers.get("content-security-policy")).toBe(policy);
+  expect(response.headers.has("x-frame-options")).toBe(false);
+  expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+  expect(response.headers.get("strict-transport-security")).toContain("max-age=");
+});
+test("ordinary routes keep defaults and a route without frame-ancestors keeps frame restrictions", () => {
+  const ordinary = withSecurityHeaders(request, new Response("app"), "production", {
+    routeContentSecurityPolicy: true,
+  });
+  expect(ordinary.headers.get("content-security-policy")).toContain("default-src 'self'");
+  expect(ordinary.headers.get("x-frame-options")).toBe("SAMEORIGIN");
+  const staticResponse = withSecurityHeaders(
+    request,
+    new Response("static", {
+      headers: { "content-security-policy": "default-src 'none'; sandbox" },
+    }),
+    "production",
+    { routeContentSecurityPolicy: true },
+  );
+  expect(staticResponse.headers.get("content-security-policy")).toBe("default-src 'none'; sandbox");
+  expect(staticResponse.headers.get("x-frame-options")).toBe("SAMEORIGIN");
+});