"""B-43: the Caddyfile must keep sending baseline security headers. Caddy adds
none of these on its own, and the JWT lives in localStorage, so a regression
here silently reopens an XSS/clickjacking exposure with no test ever failing
in the Python suite (the Caddyfile isn't imported/exercised by anything else)."""

from pathlib import Path

CADDYFILE = (Path(__file__).parent.parent.parent / "Caddyfile").read_text()


def test_header_block_present():
    assert "header {" in CADDYFILE


def test_hsts_is_set():
    assert "Strict-Transport-Security" in CADDYFILE
    assert "max-age=" in CADDYFILE


def test_nosniff_is_set():
    assert 'X-Content-Type-Options "nosniff"' in CADDYFILE


def test_frame_ancestors_are_blocked():
    assert 'X-Frame-Options "DENY"' in CADDYFILE
    assert "frame-ancestors 'none'" in CADDYFILE


def test_referrer_policy_is_set():
    assert "Referrer-Policy" in CADDYFILE


def test_csp_default_src_is_self():
    assert "Content-Security-Policy" in CADDYFILE
    assert "default-src 'self'" in CADDYFILE