Files
computer-playbook/roles/web-app-wordpress/files/playwright/test-csp.js
kevinveenbirkenbachandClaude Opus 4.8 4c91df5de7 test(e2e): forbid raw page.goto, migrate all specs to Tor-resilient gotoOnion
New lint test_no_raw_goto.py forbids raw `page.goto(...)` in role playwright specs + persona flows (the gotoOnion wrapper in personas/utils is exempt) so navigation retries transient Tor-transport errors over onion. Migrates every raw call across ~75 roles (343 sites) to `gotoOnion(page, ...)` and teaches gotoOnion to detect relative onion URLs (`isOnionCanonical`). gotoOnion is a behaviour-identical drop-in on clearnet (single attempt, same return). Verified: no-raw-goto lint green, eslint 0 errors, make test green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-08 20:59:38 +02:00

33 lines
1.2 KiB
JavaScript

const { test, expect } = require("@playwright/test");
const {
assertCspMetaParity,
assertCspResponseHeader,
expectNoCspViolations,
gotoOnion,
} = require("./personas");
// Baseline scenarios MUST NOT gate on any service.
exports.register = function (shared) {
test("wordpress front page enforces Content-Security-Policy and renders canonical domain", async ({
page,
}) => {
const diagnostics = shared.attachDiagnostics(page);
const response = await gotoOnion(page, `${shared.env.wpBaseUrl}/`);
expect(response, "Expected WordPress front page response").toBeTruthy();
expect(
response.status(),
"Expected WordPress front page response to be successful"
).toBeLessThan(400);
const directives = assertCspResponseHeader(response, "wordpress front page");
await assertCspMetaParity(page, directives, "wordpress front page");
const html = await response.text();
expect(
html.includes(shared.env.canonicalDomain) ||
(await page.content()).includes(shared.env.canonicalDomain),
`Expected canonical domain "${shared.env.canonicalDomain}" (from applications lookup) to appear in the WordPress UI`
).toBe(true);
await expectNoCspViolations(page, diagnostics, "wordpress front page");
});
};