v0.3.8-pre.002

crates/ksp-app-store-desk/tests/desktop_security.rs

@@ -0,0 +1,51 @@
+// file: crates/ksp-app-store-desk/tests/desktop_security.rs
+// version: 1
+
+fn parse_json(source: &str) -> serde_json::Result<serde_json::Value> {
+    serde_json::from_str::<serde_json::Value>(source)
+}
+
+#[test]
+fn pre_002_capabilities_are_core_and_tracing_only() {
+    let parsed = parse_json(include_str!("../capabilities/default.json"));
+    assert!(parsed.is_ok(), "committed capability JSON must be valid");
+    let capability = match parsed {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let permissions = capability["permissions"].as_array();
+    assert!(permissions.is_some(), "capability permissions must be an array");
+    let permissions = match permissions {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    assert_eq!(permissions.len(), 2);
+    assert_eq!(permissions[0], "core:default");
+    assert_eq!(permissions[1], "tracing:default");
+}
+
+#[test]
+fn pre_002_frontend_avoids_network_browser_storage_and_blocking_dialogs() {
+    let frontend = [
+        include_str!("../frontend/ts/frontend_log.ts"),
+        include_str!("../frontend/ts/invoke.ts"),
+        include_str!("../frontend/ts/main.ts"),
+        include_str!("../frontend/ts/splash.ts"),
+    ]
+    .join("\n");
+    for forbidden in ["fetch(", "XMLHttpRequest", "localStorage", "sessionStorage", "window.alert", "window.confirm", "window.prompt"] {
+        assert!(!frontend.contains(forbidden), "forbidden frontend primitive present: {forbidden}");
+    }
+}
+
+#[test]
+fn pre_002_frontend_tracing_covers_navigation_buttons_refresh_and_ipc() {
+    let main = include_str!("../frontend/ts/main.ts");
+    let invoke = include_str!("../frontend/ts/invoke.ts");
+    assert!(main.contains("navigation button clicked"));
+    assert!(main.contains("diagnostics refresh button clicked"));
+    assert!(main.contains("view activated"));
+    assert!(invoke.contains("IPC command requested"));
+    assert!(invoke.contains("IPC command completed"));
+    assert!(invoke.contains("IPC command failed"));
+}