From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 18 Jul 2026 16:30:31 +0200
Subject: Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports
---
 test/controllers/csp_reports_controller_test.rb |  8 ++++++++
 test/integration/csp_header_test.rb             | 12 ++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 test/controllers/csp_reports_controller_test.rb
 create mode 100644 test/integration/csp_header_test.rb

(limited to 'test')

diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end
diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb
new file mode 100644
index 0000000..73707ed
--- /dev/null
+++ b/test/integration/csp_header_test.rb
@@ -0,0 +1,12 @@
+require 'test_helper'
+
+class CspHeaderTest < ActionDispatch::IntegrationTest
+  test "public responses carry the report-only CSP header with a nonce" do
+    get "/"
+
+    header = response.headers["Content-Security-Policy-Report-Only"]
+    assert header.present?
+    assert_includes header, "script-src"
+    assert_includes header, "nonce-"
+  end
+end
-- 
cgit v1.3