Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports

2 files changed, 20 insertions, 0 deletions

diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end
diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb
new file mode 100644
index 0000000..73707ed
--- /dev/null
+++ b/test/integration/csp_header_test.rb
@@ -0,0 +1,12 @@
+require 'test_helper'
+
+class CspHeaderTest < ActionDispatch::IntegrationTest
+  test "public responses carry the report-only CSP header with a nonce" do
+    get "/"
+
+    header = response.headers["Content-Security-Policy-Report-Only"]
+    assert header.present?
+    assert_includes header, "script-src"
+    assert_includes header, "nonce-"
+  end
+end