computer-playbook/roles/web-app-moodle/files/playwright/test-baseline.js

const { test, expect } = require("@playwright/test");
const { resolveTimeout } = require("./timeouts");
const { decodeDotenvQuotedValue, gotoOnion } = require("./personas");

const canonicalDomain = decodeDotenvQuotedValue(process.env.CANONICAL_DOMAIN);

exports.register = function (shared) {
  test("moodle baseline: landing page reachable + canonical domain in URL", async ({ page }) => {
    const response = await gotoOnion(page, `${shared.env.moodleBaseUrl}/`);
    expect(response, "expected response").toBeTruthy();
    expect(response.status(), "landing status < 400").toBeLessThan(400);
    expect(
      response.url().includes(canonicalDomain),
      `expected canonical domain "${canonicalDomain}" in url`
    ).toBe(true);
  });

  test("moodle baseline: CSP header present, no violations on landing", async ({ page }) => {
    const response = await gotoOnion(page, `${shared.env.moodleBaseUrl}/`);
    const csp = response.headers()["content-security-policy"];
    expect(csp, "Content-Security-Policy header expected").toBeTruthy();
    await page.waitForTimeout(resolveTimeout(500));
    const violations = await page.evaluate(() => window.__cspViolations || []);
    expect(violations, `unexpected CSP violations: ${JSON.stringify(violations)}`).toEqual([]);
  });
};