cinny/src/swShare.test.ts

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { isTrustedShareRequest, shareDraftText } from './swShare';

const base = { files: [], receivedAt: 0 };

test('shareDraftText joins title, text and url', () => {
  assert.equal(
    shareDraftText({ ...base, title: 'A page', text: 'look at this', url: 'https://x.test/p' }),
    'A page\nlook at this\nhttps://x.test/p',
  );
});

test('shareDraftText drops a title/url the text already contains', () => {
  assert.equal(
    shareDraftText({
      ...base,
      title: 'A page',
      text: 'A page https://x.test/p',
      url: 'https://x.test/p',
    }),
    'A page https://x.test/p',
  );
  assert.equal(shareDraftText({ ...base, text: 'from the share sheet' }), 'from the share sheet');
  assert.equal(shareDraftText({ ...base, url: 'https://x.test' }), 'https://x.test');
  assert.equal(shareDraftText(base), '');
});

test('[#267] a share another website submitted is refused', () => {
  const app = 'https://chat.lotusguild.org';
  const h = (origin?: string) => new Headers(origin ? { Origin: origin } : {});
  assert.equal(isTrustedShareRequest(h(), app), true, 'no Origin (OS share sheet)');
  assert.equal(isTrustedShareRequest(h('null'), app), true, 'opaque origin (OS share sheet)');
  assert.equal(isTrustedShareRequest(h(app), app), true, 'the app itself');
  assert.equal(isTrustedShareRequest(h('https://evil.example'), app), false);
  assert.equal(isTrustedShareRequest(h('https://chat.lotusguild.org.evil.example'), app), false);
  assert.equal(isTrustedShareRequest(h('http://chat.lotusguild.org'), app), false, 'other scheme');
});