Qlyra/test/web_app_security_policy_test.dart

import 'package:flutter_test/flutter_test.dart';
import 'package:qlyra/frontend/screens/webapp/web_app_security_policy.dart';

void main() {
  group('WebAppSecurityPolicy', () {
    test('requires an HTTPS launch URL', () {
      expect(
        () => WebAppSecurityPolicy.fromLaunchUrl('http://mini.invalid/app'),
        throwsFormatException,
      );
      expect(
        () => WebAppSecurityPolicy.fromLaunchUrl('https://mini.invalid/app'),
        returnsNormally,
      );
    });

    test('allows only explicitly listed top-level origins', () {
      final policy = WebAppSecurityPolicy.fromLaunchUrl(
        'https://mini.invalid/start',
        additionalOrigins: const ['https://auth.invalid/login'],
      );

      expect(
        policy.allowsNavigation(Uri.parse('https://mini.invalid/next')),
        isTrue,
      );
      expect(
        policy.allowsNavigation(Uri.parse('https://auth.invalid/return')),
        isTrue,
      );
      expect(
        policy.allowsNavigation(Uri.parse('https://other.invalid/')),
        isFalse,
      );
      expect(
        policy.allowsNavigation(Uri.parse('http://mini.invalid/')),
        isFalse,
      );
    });

    test('denies permission requests from unlisted or inactive origins', () {
      final policy = WebAppSecurityPolicy.fromLaunchUrl(
        'https://mini.invalid/app',
      );

      expect(
        policy.allowsPermission(
          Uri.parse('https://mini.invalid'),
          Uri.parse('https://mini.invalid/page'),
        ),
        isTrue,
      );
      expect(
        policy.allowsPermission(
          Uri.parse('https://other.invalid'),
          Uri.parse('https://mini.invalid/page'),
        ),
        isFalse,
      );
      expect(
        policy.allowsPermission(
          Uri.parse('https://mini.invalid'),
          Uri.parse('https://other.invalid/page'),
        ),
        isFalse,
      );
    });
  });
}