lotobo/toolbox-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Release Toolbox v0.19.0

Browse Source
This commit is contained in:
zemion
2026-09-01 16:29:17 +02:00
parent ea5f76554a
commit 45dcaff659
16 changed files with 661 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deployment.test.ts
+49 -3
View File
@@ -54,6 +54,30 @@ const expectedAppTargets = [
'time',
'text',
'unicode',
'flow',
'subtitle',
'midi',
'3d',
'query',
'scan',
'package',
'label',
'font',
'fixture',
'minimize',
'format-lab',
'repro',
'schema',
'log',
'binary',
'git',
'api',
'mail',
'calendar',
'contact',
'diagram',
'token',
'device',
] as const;
const immutableCacheControl = 'public, max-age=31536000, immutable';
@@ -202,9 +226,21 @@ describe('production deployment', () => {
expect(compose).not.toContain('addideas-auth-stripprefix');
});
it('grants camera only to the isolated authentication host and barcode path', () => {
expect(nginxConfig).toMatch(
/map "\$host:\$uri" \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"~\^auth\\\.toolbox\\\.add-ideas\\\.de:" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"~\^\[\^:\]\+:\/apps\/barcode\(\?:\/\|\$\)" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu
it('scopes camera and device probes while denying sensitive features by default', () => {
expect(nginxConfig).toContain(
'default "camera=(), microphone=(), display-capture=(), geolocation=(), payment=(), usb=()";'
);
expect(nginxConfig).toContain(
'"~^auth\\.toolbox\\.add-ideas\\.de:" "camera=(self), microphone=(), display-capture=(), geolocation=(), payment=(), usb=()";'
);
expect(nginxConfig).toContain(
'"~^[^:]+:/apps/barcode(?:/|$)" "camera=(self), microphone=(), display-capture=(), geolocation=(), payment=(), usb=()";'
);
expect(nginxConfig).toContain(
'"~^[^:]+:/apps/scan(?:/|$)" "camera=(self), microphone=(), display-capture=(), geolocation=(), payment=(), usb=()";'
);
expect(nginxConfig).toContain(
'"~^[^:]+:/apps/device(?:/|$)" "camera=(self), microphone=(self), display-capture=(self), geolocation=(), payment=(), usb=()";'
);
expect(nginxConfig).toContain(
'add_header Permissions-Policy $toolbox_permissions_policy always;'
@@ -297,10 +333,20 @@ describe('production deployment', () => {
expect(staticLocationIndex).toBeGreaterThan(moduleLocationIndex);
});
it('serves bundled Scan OCR language data as gzip without widening the static route', () => {
const languageLocation =
/location ~\* \^\/apps\/scan\/ocr\/lang\/\[a-z0-9_-\]\+\\\.traineddata\\\.gz\$\s*\{\s*types\s*\{\s*application\/gzip gz;\s*\}\s*try_files \$uri =404;\s*\}/mu;
expect(nginxConfig).toMatch(languageLocation);
expect(nginxConfig).not.toMatch(
/location ~\* \\.\(\?:[^\n)]*\bgz\b[^\n)]*\)/u
);
});
it('allows same-origin WebAssembly workers and local blob media previews', () => {
expect(nginxConfig).toContain("script-src 'self' 'wasm-unsafe-eval'");
expect(nginxConfig).toContain("worker-src 'self' blob:");
expect(nginxConfig).toContain("media-src 'self' blob:");
expect(nginxConfig).toContain("font-src 'self' data: blob:");
expect(nginxConfig).not.toContain("'unsafe-eval'");
});