restrict browser permissions on API responses

2026-09-06 18:25:05 +03:00
parent 7fe7701cec
commit 404bfc4972
3 changed files with 8 additions and 0 deletions
@@ -37,6 +37,7 @@ test('HTTP preparation requires auth, persists draft and rejects stale revisions
 assert.equal(unauthorized.status,401);
 assert.equal(unauthorized.headers.get('x-content-type-options'),'nosniff');
 assert.equal(unauthorized.headers.get('referrer-policy'),'no-referrer');
+ assert.equal(unauthorized.headers.get('permissions-policy'),'camera=(), microphone=(), geolocation=()');
 assert.equal(unauthorized.headers.get('vary'),'Origin');
 const draft={firma:{firmaUnvan:'QA Laboratuvar'},priceSchema:1,pricesBySource:{kit1:'12.50'},gecerlilikGun:'120',checks:{products:{kit1:{product:'Test kit',status:'suitable',source:'Teknik 3.2'}},documents:{doc1:{status:'verified',evidence:'Test v1'}}},manualDocuments:[{document:'Yetki',note:'7.1',mandatory:true}],analysisSource:{itemsAndSpecs:[{name:'Kit',quantity:'2 adet'}],documentChecklist:[]}};
 const data={key:'2026/1582991',patch:{takipte:true,gorev:{kontrolListesi:[]},bidDraft:draft,checklist:[{key:'collect-documents',sourceSnapshot:'source-v1',done:true}]},snapshot:{id:'ilan-qa',ikn:'2026/1582991'},version:0};