---
test_name: headers should be set
stages:
  - name: account_hello returns headers
    request:
      url: "{grass_host}{account_hello}"
      method: GET
    response:
      status_code: 403
      headers:
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        referrer-policy: same-origin
        x-frame-options: SAMEORIGIN
        expires: '0'
        vary: Accept-Encoding, Accept-Encoding,Origin
        cache-control: no-cache
        pragma: no-cache
        x-content-type-options: nosniff
        content-security-policy: default-src 'none';frame-ancestors 'none';object-src 'none';upgrade-insecure-requests

---
test_name: cache control header should not be overriden to no-cache when part of endpoint's response
stages:
  - name: product_configuration_public_distribution_formats returns headers
    request:
      url: "{grass_host}{product_configuration_public_distribution_formats}"
      method: GET
    response:
      status_code: 200
      headers:
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        referrer-policy: same-origin
        x-frame-options: SAMEORIGIN
        vary: Accept-Encoding, Accept-Encoding,Origin
        cache-control: max-age=3600
        x-content-type-options: nosniff
        content-security-policy: default-src 'none';frame-ancestors 'none';object-src 'none';upgrade-insecure-requests

---
test_name: if valid origin is provided, cors headers should be set

marks:
  - parametrize:
      key: origin
      vals:
        - oa.bshah.infosec.devorch.com
        - workstation.qaorch.com
        - workstation.qaawal.com
        - oa.qaorch.com
        - podcast.qaorch.com
        - sonymusic.qaorch.com
        - sonymusic.qaoverdrive.com
        - insights.qaorch.com
        - insights.qaawal.com
        - insights.qapdesuite.com
        - settings.qaorch.com
        - settings.qaawal.com
        - audience.qaorch.com
        - audience.qaawal.com
        - audience.qapdesuite.com
        - fansifter.qaorch.com
        - fansifter.qaawal.com
        - fansifter.qapdesuite.com
        - content.qaorch.com
        - qa-frontend-content-review-standalone.theorchard.io
        - moneyhub.qaorch.com
        - moneyhub.qaawal.com
        - publishing.qaorch.com
        - abacus.qaorch.com
        - collaborators.qaorch.com
        - distribution.qaorch.com
        - documents.qaawal.com
        - documents.qaorch.com
        - collaborators.qaawal.com
        - playground.qaorch.com
        - playground.qaawal.com
        - solfege.qaorch.com
        - solfege.qaawal.com
        - settings.qakollectivenr.com
        - settings.qapdesuite.com
        - moneyhub.qakollectivenr.com
        - grassproxy.pullrequests.qaorch.com

stages:
  - name: account_hello returns headers
    request:
      url: "{grass_host}{account_hello}"
      method: GET
      headers:
        origin: "https://{origin}"
    response:
      status_code: 403
      headers:
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        referrer-policy: same-origin
        x-frame-options: SAMEORIGIN
        expires: '0'
        vary: Accept-Encoding, Accept-Encoding,Origin
        cache-control: no-cache
        pragma: no-cache
        x-content-type-options: nosniff
        Access-Control-Allow-Origin: "https://{origin}"
        content-security-policy: default-src 'none';frame-ancestors 'none';object-src 'none';upgrade-insecure-requests

---
test_name: if invalid origin is provided, cors headers should not be set
stages:
  - name: account_hello returns headers
    request:
      url: "{grass_host}{account_hello}"
      method: GET
      headers:
        origin: "invalid origin"
    response:
      status_code: 403
      verify_response_with:
        function: tests.integration.api_contracts.utils:assert_key_not_in_headers
        extra_kwargs:
          header_key: access-control-allow-origin
      headers:
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        referrer-policy: same-origin
        x-frame-options: SAMEORIGIN
        expires: '0'
        vary: Accept-Encoding, Accept-Encoding,Origin
        cache-control: no-cache
        pragma: no-cache
        x-content-type-options: nosniff
        content-security-policy: default-src 'none';frame-ancestors 'none';object-src 'none';upgrade-insecure-requests