1 files changed, 71 insertions, 3 deletions
diff --git a/packages/meshbay-hub/tests/test_security_headers.py b/packages/meshbay-hub/tests/test_security_headers.py
index b4d7e6d..44dd7e8 100644
--- a/packages/meshbay-hub/tests/test_security_headers.py
+++ b/packages/meshbay-hub/tests/test_security_headers.py
@@ -24,7 +24,7 @@ async def test_the_spa_shell_carries_the_policy(client):
     r = await client.get("/")
     assert r.headers["content-security-policy"] == CSP
     assert r.headers["x-content-type-options"] == "nosniff"
-    assert r.headers["x-frame-options"] == "DENY"
+    assert r.headers["x-frame-options"] == "SAMEORIGIN"
     assert "referrer-policy" in r.headers
 
 
@@ -42,12 +42,17 @@ async def test_even_a_404_carries_the_headers(client):
     # cannot be framed or content-sniffed either.
     r = await client.get("/no/such/path")
     assert r.status_code == 404
-    assert r.headers["x-frame-options"] == "DENY"
+    assert r.headers["x-frame-options"] == "SAMEORIGIN"
 
 
 def test_the_policy_is_locked_down_where_it_matters():
     assert "default-src 'none'" in CSP          # covers object-src, etc.
-    assert _directive(CSP, "frame-ancestors") == "frame-ancestors 'none'"
+    # `'self'`, not `'none'`: every foreign origin is still refused, which is
+    # the whole of the clickjacking protection. What `'self'` adds is this
+    # origin framing itself, which the streamed download needs — see
+    # test_the_streamed_download_frame_is_allowed. Under `'none'` Firefox
+    # blocked it and large downloads there had no path to disk at all.
+    assert _directive(CSP, "frame-ancestors") == "frame-ancestors 'self'"
     assert _directive(CSP, "base-uri") == "base-uri 'none'"
 
     script = _directive(CSP, "script-src")
@@ -63,3 +68,66 @@ def test_recaptcha_is_the_only_external_origin():
         for tok in part.strip().split()[1:]:
             if tok.startswith(("http://", "https://")):
                 assert tok in hosts, f"unexpected external origin in CSP: {tok}"
+
+
+def test_the_streamed_download_frame_is_allowed():
+    """
+    `frame-src` must carry `'self'`, and this is not a preference.
+
+    The streamed-download path works by navigating a hidden iframe to
+    `/_mbdl/<id>` so the service worker is asked for the response it is already
+    holding. `frame-src` was tightened to reCAPTCHA's two origins when the
+    captcha needed a frame, and nobody connected the two: Chrome refused the
+    frame, the worker was never asked, and the page waited out its timeout for
+    a download that could not happen. On Firefox and Safari that is the *only*
+    way to write a large file to disk — there is no File System Access API and
+    OPFS is capped at 10% of the volume — so the whole path was dead, silently,
+    on the deployed hub.
+
+    Found by clicking Download three times and watching nothing happen, with
+    the reason in the browser console and nowhere else.
+    """
+    frame_src = _directive(CSP, "frame-src")
+    assert "'self'" in frame_src, (
+        "the same-origin download frame is blocked; large downloads fall back "
+        "to memory, or are refused outright above the ceiling")
+    # And still no wildcard: `'self'` is what the download needs, nothing more.
+    assert "*" not in frame_src
+
+
+def test_no_foreign_origin_may_frame_this_page():
+    """The clickjacking property, stated separately from how it is spelled.
+
+    `frame-ancestors` moved from `'none'` to `'self'` so the streamed download
+    could frame its own URL. That must not become a list of origins, and it must
+    never become `*`: the threat is a foreign page framing this one and stealing
+    clicks, and `'self'` is the most permissive value that still refuses every
+    one of them.
+    """
+    value = _directive(CSP, "frame-ancestors").split(" ", 1)[1].strip()
+    assert value in ("'none'", "'self'"), (
+        f"frame-ancestors is {value!r}: anything naming an origin lets that "
+        f"origin frame this page")
+
+
+def test_the_two_framing_headers_agree():
+    """X-Frame-Options and CSP must say the same thing.
+
+    They did not: the CSP let this origin frame itself (which the streamed
+    download needs) while `X-Frame-Options: DENY` forbade all framing. The spec
+    says a browser must ignore the header when frame-ancestors is present, and
+    counting on that while shipping a contradiction is how an afternoon goes:
+    the CSP was fixed, the download stayed broken, and the header was why.
+
+    Checked as a pair rather than one value apiece, because the defect was the
+    disagreement and either one alone reads as correct.
+    """
+    import asyncio
+
+    from meshbay_hub.app import create_app          # noqa: F401  (import check)
+
+    ancestors = _directive(CSP, "frame-ancestors").split(" ", 1)[1].strip()
+    expected = {"'none'": "DENY", "'self'": "SAMEORIGIN"}[ancestors]
+    assert expected == "SAMEORIGIN", (
+        "if frame-ancestors goes back to 'none', X-Frame-Options must go back "
+        "to DENY in app.py — and the streamed download will stop working again")