mirror of
https://github.com/discourse/discourse-ai.git
synced 2025-02-08 20:44:42 +00:00
52c644798d
1. Keep source in a "details" block after rendered so it does not overwhelm users 2. Ensure artifacts are never indexed by robots 3. Cache break our CSS that changed recently
79 lines
2.4 KiB
Ruby
79 lines
2.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe DiscourseAi::AiBot::ArtifactsController do
|
|
fab!(:user)
|
|
fab!(:topic) { Fabricate(:private_message_topic, user: user) }
|
|
fab!(:post) { Fabricate(:post, user: user, topic: topic) }
|
|
fab!(:artifact) do
|
|
AiArtifact.create!(
|
|
user: user,
|
|
post: post,
|
|
name: "Test Artifact",
|
|
html: "<div>Hello World</div>",
|
|
css: "div { color: blue; }",
|
|
js: "console.log('test');",
|
|
metadata: {
|
|
public: false,
|
|
},
|
|
)
|
|
end
|
|
|
|
def parse_srcdoc(html)
|
|
Nokogiri.HTML5(html).at_css("iframe")["srcdoc"]
|
|
end
|
|
|
|
before do
|
|
SiteSetting.discourse_ai_enabled = true
|
|
SiteSetting.ai_artifact_security = "strict"
|
|
end
|
|
|
|
describe "#show" do
|
|
it "returns 404 when discourse_ai is disabled" do
|
|
SiteSetting.discourse_ai_enabled = false
|
|
get "/discourse-ai/ai-bot/artifacts/#{artifact.id}"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "returns 404 when ai_artifact_security disables it" do
|
|
SiteSetting.ai_artifact_security = "disabled"
|
|
get "/discourse-ai/ai-bot/artifacts/#{artifact.id}"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
context "with private artifact" do
|
|
it "returns 404 when user cannot see the post" do
|
|
get "/discourse-ai/ai-bot/artifacts/#{artifact.id}"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "shows artifact when user can see the post" do
|
|
sign_in(user)
|
|
get "/discourse-ai/ai-bot/artifacts/#{artifact.id}"
|
|
expect(response.status).to eq(200)
|
|
untrusted_html = parse_srcdoc(response.body)
|
|
expect(untrusted_html).to include(artifact.html)
|
|
expect(untrusted_html).to include(artifact.css)
|
|
expect(untrusted_html).to include(artifact.js)
|
|
end
|
|
end
|
|
|
|
context "with public artifact" do
|
|
before { artifact.update!(metadata: { public: true }) }
|
|
|
|
it "shows artifact without authentication" do
|
|
get "/discourse-ai/ai-bot/artifacts/#{artifact.id}"
|
|
expect(response.status).to eq(200)
|
|
expect(parse_srcdoc(response.body)).to include(artifact.html)
|
|
end
|
|
end
|
|
|
|
it "removes security headers and disables crawling" do
|
|
sign_in(user)
|
|
get "/discourse-ai/ai-bot/artifacts/#{artifact.id}"
|
|
expect(response.headers["X-Frame-Options"]).to eq(nil)
|
|
expect(response.headers["Content-Security-Policy"]).to eq("script-src 'unsafe-inline';")
|
|
expect(response.headers["X-Robots-Tag"]).to eq("noindex")
|
|
end
|
|
end
|
|
end
|