perf: prepared statements, CSP, digest pin, вырезание design-preview, нагрузочные бюджеты, jsdom-тесты web, composite CI, SBOM/Trivy

apps/api/test/http-layer.test.ts

@@ -178,3 +178,55 @@ describe('CORS', () => {
     expect(all('https://anything.example')).toBe(true)
   })
 })
+
+describe('сжатие в Node (ENABLE_COMPRESS)', () => {
+  async function withBigRoute(env: NodeJS.ProcessEnv) {
+    app = await buildTestApp(env)
+    app.get('/__big', async () => ({ data: 'x'.repeat(5000) }))
+    app.get('/__small', async () => ({ ok: true }))
+    return app
+  }
+
+  it('по умолчанию выключено', async () => {
+    const a = await withBigRoute({})
+    const res = await a.inject({
+      method: 'GET',
+      url: '/__big',
+      headers: { 'accept-encoding': 'gzip' },
+    })
+    expect(res.headers['content-encoding']).toBeUndefined()
+  })
+
+  it('включено: большой JSON сжимается, маленький нет, без Accept-Encoding нет', async () => {
+    const a = await withBigRoute({ ENABLE_COMPRESS: 'true' })
+    const big = await a.inject({
+      method: 'GET',
+      url: '/__big',
+      headers: { 'accept-encoding': 'gzip' },
+    })
+    expect(big.headers['content-encoding']).toBe('gzip')
+    expect(big.rawPayload.length).toBeLessThan(500)
+    const small = await a.inject({
+      method: 'GET',
+      url: '/__small',
+      headers: { 'accept-encoding': 'gzip' },
+    })
+    expect(small.headers['content-encoding']).toBeUndefined()
+    const none = await a.inject({ method: 'GET', url: '/__big' })
+    expect(none.headers['content-encoding']).toBeUndefined()
+  })
+});
+
+describe('CSP', () => {
+  it('отдаётся жёсткая политика без внешних источников', async () => {
+    app = await buildTestApp()
+    const res = await app.inject({ method: 'GET', url: '/health' })
+    const csp = String(res.headers['content-security-policy'])
+    expect(csp).toContain("default-src 'self'")
+    expect(csp).toContain("script-src 'self'")
+    expect(csp).toContain("frame-ancestors 'none'")
+    expect(csp).toContain("object-src 'none'")
+    expect(csp).not.toMatch(/script-src[^;]*'unsafe-inline'/)
+    expect(csp).not.toContain('http:')
+  })
+})