Feat/deep merge

.github/workflows/release.yml

@@ -23,6 +23,20 @@ jobs:
           name: package-dist
           retention-days: 30
           path: packages/vite-plugin-hash-csp/dist
+      - name: Run Unit Tests
+        run: pnpm p:test
+
+      - name: Install Playwright Browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Run tests
+        run: pnpm test
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 5
 
   publish:
     runs-on: ubuntu-latest

.github/workflows/triage.yml

@@ -27,7 +27,7 @@ jobs:
         run: npx playwright install --with-deps chromium
 
       - name: Run tests
-        run: npm run test
+        run: pnpm test
       - uses: actions/upload-artifact@v4
         if: always()
         with:

packages/vite-plugin-hash-csp/src/utils.ts

@@ -39,10 +39,28 @@ export const htmlFilter = createFilter("**.html");
 export const mergePolicies = (
   defaultPolicy: CSPPolicy,
   userPolicy: CSPPolicy | undefined
-) => {
+): CSPPolicy => {
   if (!userPolicy) return defaultPolicy;
-  // Simple object merge; we might be able to get away without deep merge
-  return { ...defaultPolicy, ...userPolicy };
+
+  const mergedPolicy: CSPPolicy = { ...defaultPolicy };
+
+  for (const key in userPolicy as CSPPolicy) {
+    const _key = key as keyof CSPPolicy;
+    if (userPolicy.hasOwnProperty(key)) {
+      const defaultValues = defaultPolicy[_key] || [];
+      const userValues = userPolicy[_key] || [];
+
+      if (Array.isArray(userValues)) {
+        mergedPolicy[_key] = Array.from(
+          new Set([...defaultValues, ...userValues])
+        );
+      } else {
+        mergedPolicy[_key] = userValues;
+      }
+    }
+  }
+
+  return mergedPolicy;
 };
 
 export const parseOutliers = (outliers: Array<Outlier>) => {

packages/vite-plugin-hash-csp/tests/policies.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from "vitest";
+import { CSPPolicy } from "../src/types";
+import { mergePolicies } from "../src/utils";
+import { DEFAULT_POLICY } from "../src/policy/constants";
+
+describe("Policy Tests", () => {
+  test("Simple Policy Merge", () => {
+    const policy: CSPPolicy = {
+      "frame-src": ["example.com"],
+    };
+    const mergedPolicy = mergePolicies(DEFAULT_POLICY, policy);
+
+    expect(mergedPolicy).toEqual({
+      "default-src": ["'self'"],
+      "img-src": ["'self'", "data:"],
+      "script-src-elem": ["'self'"],
+      "style-src-elem": ["'self'"],
+      "frame-src": ["example.com"],
+    });
+  });
+
+  test("Deep Policy Merge", () => {
+    const policy: CSPPolicy = {
+      "img-src": ["example.com"],
+    };
+
+    const mergedPolicy = mergePolicies(DEFAULT_POLICY, policy);
+
+    expect(mergedPolicy).toEqual({
+      "default-src": ["'self'"],
+      "img-src": ["'self'", "data:", "example.com"],
+      "script-src-elem": ["'self'"],
+      "style-src-elem": ["'self'"],
+    });
+  });
+});