Release Network Tools 0.2.0

tests/browser/app.spec.ts

@@ -39,7 +39,7 @@ test("calculates a subnet and sanitises a credential-bearing URL", async ({
   await expect(
     page.getByText("Last address", { exact: true }).locator("..").locator("dd"),
   ).toHaveText("192.168.10.255");
-  await page.getByRole("tab", { name: "URL" }).click();
+  await page.getByRole("button", { name: "URL" }).click();
   await page
     .getByLabel("URL or reference")
     .fill("https://alice:secret@example.test/a?q=one&q=two");
@@ -51,6 +51,35 @@ test("calculates a subnet and sanitises a credential-bearing URL", async ({
   expect(external).toEqual([]);
 });
 
+test("plans VLSM and inspects a zone and deployed CSP without lookups", async ({
+  page,
+}) => {
+  const external = await localOnly(page);
+  await page.goto("/deep/nested/network/");
+
+  await page.getByRole("button", { name: "VLSM planner" }).click();
+  await expect(page.getByText("10.20.0.0/23", { exact: true })).toBeVisible();
+  await expect(page.getByText("10.20.2.0/25", { exact: true })).toBeVisible();
+
+  await page.getByRole("button", { name: "Zone file" }).click();
+  await expect(
+    page.getByText("Validated records").locator("..").locator("dd"),
+  ).toHaveText("6");
+  await expect(
+    page.locator("pre").filter({ hasText: "192.0.2.80" }),
+  ).toBeVisible();
+
+  await page.getByRole("button", { name: "HTTP & CSP" }).click();
+  await page
+    .getByLabel("Response headers")
+    .fill(
+      "Content-Security-Policy: default-src 'self'; script-src 'unsafe-eval'\nSet-Cookie: session=x; SameSite=None",
+    );
+  await expect(page.getByText(/permits 'unsafe-eval'/u)).toBeVisible();
+  await expect(page.getByText(/SameSite=None without Secure/u)).toBeVisible();
+  expect(external).toEqual([]);
+});
+
 test("serves the release identity and hardened headers", async ({
   request,
 }) => {
@@ -63,7 +92,7 @@ test("serves the release identity and hardened headers", async ({
   const manifest = await request.get("/deep/nested/network/toolbox-app.json");
   await expect(manifest.json()).resolves.toMatchObject({
     id: "de.add-ideas.network-tools",
-    version: "0.1.0",
+    version: "0.2.0",
     entry: "./",
   });
 });

tests/browser/responsive.spec.ts

@@ -0,0 +1,18 @@
+import { expect, test } from "@playwright/test";
+
+test("keeps the primary workspace inside a narrow viewport", async ({
+  page,
+}) => {
+  await page.goto("/deep/nested/network/");
+  await expect(page.locator("main").first()).toBeVisible();
+  await expect(
+    page.locator("main .loading, main .workbench-loading"),
+  ).toHaveCount(0);
+
+  const widths = await page.evaluate(() => ({
+    content: document.documentElement.scrollWidth,
+    viewport: document.documentElement.clientWidth,
+  }));
+  expect(widths.viewport).toBeLessThanOrEqual(430);
+  expect(widths.content).toBeLessThanOrEqual(widths.viewport + 1);
+});

tests/network/http-mime.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { buildCsp, inspectHeaders } from "../../src/network/http";
+import { buildCsp, inspectCsp, inspectHeaders } from "../../src/network/http";
 import { lookupMime } from "../../src/network/mime";
 
 describe("HTTP helpers", () => {
@@ -29,6 +29,83 @@ describe("HTTP helpers", () => {
     expect(result.policy).toContain("object-src 'none'");
     expect(result.warnings.join(" ")).toMatch(/unsafe-eval/u);
   });
+
+  it("analyses deployed CSP, cookies, HSTS and framing defenses", () => {
+    const result = inspectHeaders(
+      "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'\n" +
+        "Strict-Transport-Security: max-age=60\n" +
+        "Set-Cookie: session=abc; SameSite=None\n" +
+        "X-Content-Type-Options: nosniff\n" +
+        "Referrer-Policy: strict-origin",
+    );
+    expect(result.securityFindings.map((finding) => finding.code)).toEqual(
+      expect.arrayContaining([
+        "csp-unsafe-eval",
+        "hsts-short",
+        "cookie-secure",
+        "cookie-http-only",
+        "cookie-none-insecure",
+      ]),
+    );
+    expect(result.csp?.directives).toContainEqual({
+      name: "object-src",
+      values: ["'none'"],
+    });
+  });
+
+  it("identifies duplicate and dangerous CSP directives", () => {
+    const result = inspectCsp(
+      "default-src *; script-src data:; script-src 'self'",
+    );
+    expect(result.findings.map((finding) => finding.code)).toEqual(
+      expect.arrayContaining([
+        "csp-wildcard",
+        "csp-script-data",
+        "csp-duplicate-directive",
+      ]),
+    );
+  });
+
+  it("analyses every enforcing CSP field rather than silently dropping later fields", () => {
+    const result = inspectHeaders(
+      "Content-Security-Policy: default-src 'self'; object-src 'none'\n" +
+        "Content-Security-Policy: script-src 'unsafe-eval'; object-src 'none'",
+    );
+    expect(result.cspFields).toHaveLength(2);
+    expect(result.securityFindings).toContainEqual(
+      expect.objectContaining({
+        code: "csp-unsafe-eval",
+        message: expect.stringContaining("CSP field 2"),
+      }),
+    );
+  });
+
+  it("uses the first duplicate directive and validates X-Frame-Options", () => {
+    const csp = inspectCsp(
+      "default-src 'self'; object-src *; object-src 'none'",
+    );
+    expect(csp.findings.map((finding) => finding.code)).toContain(
+      "csp-object-src-open",
+    );
+    const headers = inspectHeaders(
+      "X-Frame-Options: ALLOW-FROM https://example.test",
+    );
+    expect(headers.securityFindings.map((finding) => finding.code)).toContain(
+      "x-frame-options-invalid",
+    );
+  });
+
+  it("does not apply sources from ignored duplicate CSP directives", () => {
+    const csp = inspectCsp(
+      "default-src 'self'; script-src 'self'; script-src 'unsafe-eval' data:",
+    );
+    expect(csp.findings.map((finding) => finding.code)).not.toContain(
+      "csp-unsafe-eval",
+    );
+    expect(csp.findings.map((finding) => finding.code)).toContain(
+      "csp-duplicate-directive",
+    );
+  });
 });
 
 describe("MIME lookup", () => {

tests/network/url-dns.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { buildDnsRecord } from "../../src/network/dns";
+import { buildDnsRecord, inspectDnsZone } from "../../src/network/dns";
+import { parseVlsmRequirements, planVlsm } from "../../src/network/vlsm";
 import { buildUrl, inspectUrl } from "../../src/network/url";
 
 describe("URL inspection", () => {
@@ -73,4 +74,91 @@ describe("DNS construction", () => {
       buildDnsRecord({ owner: "@", ttl: 60, type: "AAAA", value: "::::" }),
     ).toThrow(/IPv6/u);
   });
+
+  it("parses a bounded zone inertly and validates common record data", () => {
+    const result = inspectDnsZone(
+      "$ORIGIN example.test.\n$TTL 1h\n@ IN SOA ns hostmaster 1 1h 15m 1w 5m\n@ IN NS ns\nns IN A 192.0.2.1\n    IN AAAA 2001:db8::1\n_unknown IN SVCB 1 target.example.",
+    );
+    expect(result.origin).toBe("example.test.");
+    expect(result.records).toHaveLength(5);
+    expect(result.records[2]?.normalized).toContain(
+      "ns.example.test. 3600 IN A 192.0.2.1",
+    );
+    expect(result.records[3]?.owner).toBe("ns.example.test.");
+    expect(result.coverage).toMatchObject({
+      validatedRecords: 4,
+      syntaxOnlyRecords: 1,
+    });
+    expect(result.diagnostics[0]?.message).toMatch(/syntax-only/u);
+  });
+
+  it("rejects include directives without reading external files", () => {
+    const result = inspectDnsZone("$INCLUDE secrets.zone");
+    expect(result.records).toEqual([]);
+    expect(result.diagnostics[0]).toMatchObject({ severity: "error" });
+  });
+
+  it("accepts wildcard/root owners and keeps non-IN records syntax-only", () => {
+    const result = inspectDnsZone(
+      "$ORIGIN example.test.\n*.web IN A 192.0.2.9\n. IN NS a.root-servers.net.\nlegacy CH A not-an-ip",
+    );
+    expect(result.records.map((record) => record.owner)).toEqual([
+      "*.web.example.test.",
+      ".",
+      "legacy.example.test.",
+    ]);
+    expect(result.records[2]).toMatchObject({
+      dnsClass: "CH",
+      validation: "syntax-only",
+      data: ["not-an-ip"],
+    });
+    expect(result.diagnostics).toContainEqual(
+      expect.objectContaining({ message: expect.stringContaining("only IN") }),
+    );
+  });
+
+  it("joins names correctly beneath the DNS root origin", () => {
+    const result = inspectDnsZone("$ORIGIN .\nwww IN A 192.0.2.10");
+    expect(result.records[0]).toMatchObject({
+      owner: "www.",
+      normalized: "www. IN A 192.0.2.10",
+    });
+    expect(result.diagnostics).toEqual([]);
+  });
+});
+
+describe("VLSM planning", () => {
+  it("allocates largest requirements first on subnet boundaries", () => {
+    const plan = planVlsm(
+      "10.0.0.0/24",
+      parseVlsmRequirements("Printers,12\nOffice,100\nLab,50"),
+    );
+    expect(plan.allocations.map((item) => item.network)).toEqual([
+      "10.0.0.0/25",
+      "10.0.0.128/26",
+      "10.0.0.192/28",
+    ]);
+    expect(plan.allocations[0]?.name).toBe("Office");
+    expect(plan.freeAddresses).toBe(48);
+  });
+
+  it("fails atomically when requirements do not fit", () => {
+    expect(() =>
+      planVlsm("192.0.2.0/29", [
+        { name: "one", hosts: 4 },
+        { name: "two", hosts: 4 },
+      ]),
+    ).toThrow(/does not fit/u);
+  });
+
+  it("supports a conventional full IPv4 /0 capacity without unsafe numbers", () => {
+    const plan = planVlsm("0.0.0.0/0", [
+      { name: "whole range", hosts: 4_294_967_294 },
+    ]);
+    expect(plan.allocations[0]).toMatchObject({
+      network: "0.0.0.0/0",
+      broadcast: "255.255.255.255",
+      usableHosts: 4_294_967_294,
+    });
+  });
 });