brain-of-reese/tests/integration/test_security_headers.py

"""Integration: the phase-82 security-header contract against the REAL app.

Phase 82 (audit SEC-04) adds a header-only, pure-ASGI middleware
(``app/core/security_headers.py``) registered OUTERMOST in
``app/main.py`` (last ``add_middleware`` — after
``configure_caching``), so every response this process serves — pages,
API JSON, static assets, even the static catch-all's 404s — carries:

* ``Content-Security-Policy`` — the exact A1 string (``default-src 'self';
  base-uri 'none'; frame-ancestors 'none'`` → clickjacking closed, no
  inline anything because the No-CDN frontend has none);
* ``X-Frame-Options: DENY`` — the legacy no-framing fallback;
* ``X-Content-Type-Options: nosniff`` — the MIME-confusion belt.

This suite pins those three on the four response shapes the browser
actually sees — a page (``/``), an API response (``/api/health``), a
static asset (``/assets/styles.css``), and a 404
(``/definitely-not-a-page`` — the outermost-position proof: the 404 is
built deep inside the static catch-all, yet the headers are still on
it) — against the real ``app.main:app`` with the real static mount on
the real ``frontend/`` tree (no mocks, same client as
``tests/integration/test_caching_revalidation.py`` via the shared
``client`` fixture). It also pins that the two middlewares coexist: the
CSP middleware is header-only, so the phase-33/54 ``?v=<token>``
rewrite from ``CachingMiddleware`` still runs under it (the last
regression below). The SSE chat stream's byte-identity is pinned by the
unit streaming test and the chat E2E suites (the tripwires).
"""
from __future__ import annotations

import httpx
from fastapi.testclient import TestClient

from app.core.security_headers import CSP

#: The exact owner-approved A1 policy string (phase 82). The constant is
#: the single source of truth; the unit suite additionally pins that the
#: constant itself equals this literal.
_EXPECTED = {
    "content-security-policy": CSP,
    "x-frame-options": "DENY",
    "x-content-type-options": "nosniff",
}


def _assert_security_headers(response: httpx.Response) -> None:
    """All three phase-82 headers present with the exact values (the
    httpx header lookup is case-insensitive)."""
    path = response.request.url.path
    for name, value in _EXPECTED.items():
        assert response.headers.get(name) == value, (
            f"{path}: {name} must be {value!r}, "
            f"got {response.headers.get(name)!r}"
        )


def test_page_carries_all_three_headers(client: TestClient) -> None:
    """``GET /`` (the shell page) — 200 + all three headers, CSP exactly
    the A1 string."""
    response = client.get("/")
    assert response.status_code == 200
    _assert_security_headers(response)
    assert response.headers["content-security-policy"] == (
        "default-src 'self'; base-uri 'none'; frame-ancestors 'none'"
    )


def test_api_health_carries_all_three_headers(client: TestClient) -> None:
    """``GET /api/health`` (an API JSON response) — 200 + all three
    headers."""
    response = client.get("/api/health")
    assert response.status_code == 200
    _assert_security_headers(response)


def test_static_asset_carries_all_three_headers(client: TestClient) -> None:
    """``GET /assets/styles.css`` (the static mount) — 200 + all three
    headers (the nosniff belt guards exactly this surface)."""
    response = client.get("/assets/styles.css")
    assert response.status_code == 200
    _assert_security_headers(response)


def test_static_catchall_404_carries_all_three_headers(client: TestClient) -> None:
    """``GET /definitely-not-a-page`` — 404 from the static catch-all,
    built deep inside the app, yet all three headers ride on it: the
    outermost-position proof (a response the middleware cannot see
    unless it wraps everything)."""
    response = client.get("/definitely-not-a-page")
    assert response.status_code == 404
    _assert_security_headers(response)


def test_caching_rewrite_still_runs_under_headers_middleware(client: TestClient) -> None:
    """Coexistence pin: the header middleware is header-only (it never
    drains or rewrites a body), so the phase-33/54 ``CachingMiddleware``
    ``?v=<token>`` asset rewrite on the same page must still run — the
    served HTML still carries at least one ``?v=`` reference."""
    response = client.get("/")
    assert response.status_code == 200
    assert response.text.count("?v=") >= 1, (
        "the ?v=<token> asset rewrite no longer runs — the outermost "
        "security-header middleware altered or swallowed the body"
    )