A R R R Associates
34 lines
1.5 KiB
JavaScript
34 lines
1.5 KiB
JavaScript
const { expect } = require('@playwright/test');
|
|
|
|
async function expectNoServerError(page) {
|
|
const body = await page.locator('body').innerText().catch(()=>'');
|
|
expect(page.url()).not.toContain('500');
|
|
expect(body).not.toMatch(/Internal Server Error|Traceback|Exception in ASGI application|AttributeError|UndefinedError/i);
|
|
}
|
|
|
|
async function expectBlockedOrSafe(page, response) {
|
|
const status = response ? response.status() : 0;
|
|
const body = await page.locator('body').innerText().catch(()=>'');
|
|
const safeStatus = [401,403,404,405,422].includes(status);
|
|
const safeText = /access denied|forbidden|unauthorized|not found|permission|login|required|invalid/i.test(body);
|
|
const redirectedLogin = page.url().includes('/login');
|
|
expect(safeStatus || safeText || redirectedLogin).toBeTruthy();
|
|
await expectNoServerError(page);
|
|
}
|
|
|
|
async function expectSecurityHeaders(response) {
|
|
const headers = response.headers();
|
|
expect(headers['x-frame-options'] || headers['content-security-policy']).toBeTruthy();
|
|
expect(headers['x-content-type-options'] || '').toMatch(/nosniff/i);
|
|
}
|
|
|
|
async function expectCookieFlags(context) {
|
|
const cookies = await context.cookies();
|
|
const session = cookies.find(c => /session|auth|token/i.test(c.name));
|
|
if (!session) return;
|
|
expect(session.httpOnly).toBeTruthy();
|
|
expect(['Lax','Strict','None'].includes(session.sameSite)).toBeTruthy();
|
|
}
|
|
|
|
module.exports = { expectNoServerError, expectBlockedOrSafe, expectSecurityHeaders, expectCookieFlags };
|