import { describe, expect, it } from "vitest";
import { resolveEmailPreviewAssets } from "./transactional-email-preview";
const CSP_HEAD =
"";
describe("resolveEmailPreviewAssets", () => {
it("uses the canonical logo for browser previews", () => {
expect(
resolveEmailPreviewAssets(
'
',
),
).toBe(`${CSP_HEAD}
`);
});
it("leaves an explicit brand logo URL as text but blocks it from loading via CSP", () => {
const html = '
';
const resolved = resolveEmailPreviewAssets(html);
expect(resolved).toBe(`${CSP_HEAD}${html}`);
});
it("prepends the CSP before an existing / instead of merging into it", () => {
const html = "HiHi";
const resolved = resolveEmailPreviewAssets(html);
expect(resolved).toBe(`${CSP_HEAD}${html}`);
});
it("prepends the CSP to a fragment with no /", () => {
const html = "Hi
";
const resolved = resolveEmailPreviewAssets(html);
expect(resolved).toBe(`${CSP_HEAD}${html}`);
});
it("stays first even when a resource tag appears before a stray ", () => {
// The reported bypass: a regex that looks for the first `` would
// insert after this `![]()
`, letting it tokenize (and start loading)
// first. Prepending unconditionally means our meta is always first.
const html = '
';
const resolved = resolveEmailPreviewAssets(html);
expect(resolved.startsWith(CSP_HEAD)).toBe(true);
expect(resolved.indexOf("Content-Security-Policy")).toBeLessThan(
resolved.indexOf("tracker.example"),
);
});
});