feat: initial commit - Jhonny Editor

- Adicionado estrutura completa do projeto
- Configurado MCP server para Premiere Pro
- Adicionado documentação e skills
- Configurado Gitignore para o projeto

code/tests/http-security.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it, vi } from "vitest";
+import { applyHttpSecurityHeaders, buildContentSecurityPolicy, HTTP_SECURITY_HEADERS } from "../src/http-security.js";
+
+describe("HTTP security headers", () => {
+  it("sets a restrictive baseline on every response", () => {
+    const setHeader = vi.fn();
+    applyHttpSecurityHeaders({ setHeader } as never);
+
+    expect(setHeader).toHaveBeenCalledWith("X-Content-Type-Options", "nosniff");
+    expect(setHeader).toHaveBeenCalledWith("X-Frame-Options", "DENY");
+    expect(setHeader).toHaveBeenCalledWith(
+      "Strict-Transport-Security",
+      "max-age=31536000; includeSubDomains",
+    );
+    expect(setHeader).toHaveBeenCalledWith(
+      "Permissions-Policy",
+      "camera=(), microphone=(), geolocation=()",
+    );
+  });
+
+  it("blocks framing, plugins, and unlisted network destinations", () => {
+    const policy = HTTP_SECURITY_HEADERS["Content-Security-Policy"];
+    expect(policy).toContain("frame-ancestors 'none'");
+    expect(policy).toContain("object-src 'none'");
+    expect(policy).toContain("connect-src 'self'");
+    expect(policy).toContain("https://www.google.com");
+    expect(policy).not.toContain("connect-src *");
+    expect(policy).not.toContain("script-src 'self' 'unsafe-inline'");
+  });
+
+  it("uses a per-response nonce instead of allowing inline scripts", () => {
+    const setHeader = vi.fn();
+    applyHttpSecurityHeaders({ setHeader } as never, { scriptNonce: "nonce-value" });
+    expect(setHeader).toHaveBeenCalledWith(
+      "Content-Security-Policy",
+      expect.stringContaining("script-src 'self' 'nonce-nonce-value' https://www.googletagmanager.com"),
+    );
+    expect(buildContentSecurityPolicy()).not.toContain("'unsafe-inline' https://www.googletagmanager.com");
+  });
+});