// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第六十九批回归闸门：CORS 收敛 + 基础安全响应头
 */
describe('第六十九批 CORS 与安全响应头闸门', () => {
  const rootDir = path.resolve(__dirname, '../../');
  const indexCode = fs.readFileSync(path.join(rootDir, 'server/src/index.ts'), 'utf-8');

  it('CORS 不再全开，改为白名单（CORS_ORIGINS）', () => {
    expect(indexCode).not.toContain('app.use(cors());');
    expect(indexCode).toContain('CORS_ORIGINS');
    expect(indexCode).toContain('allowedCorsOrigins.has(origin)');
  });

  it('设置基础安全响应头并隐藏技术栈', () => {
    expect(indexCode).toContain("app.disable('x-powered-by')");
    expect(indexCode).toContain("'X-Content-Type-Options', 'nosniff'");
    expect(indexCode).toContain("'X-Frame-Options', 'DENY'");
    expect(indexCode).toContain("'Referrer-Policy', 'no-referrer'");
    expect(indexCode).toContain('Strict-Transport-Security');
  });
});