school_compare/nextjs-app/__tests__/app/nextConfig.test.ts

/**
 * next.config.mjs carries the staging noindex rule. Breaking it turns
 * stx.schoolcompare.co.uk into a fully crawlable duplicate of production,
 * and nothing else in the suite would notice.
 *
 * The non-null assertions are deliberate: every key asserted here is optional
 * on NextConfig, and a missing one is precisely the regression under test, so
 * the assertion below should fail the test rather than the compile.
 */
import nextConfig from '@/next.config.mjs';

async function headerRules() {
  return nextConfig.headers!();
}

describe('next.config.mjs', () => {
  it('keeps the staging host out of the index', async () => {
    const headers = await headerRules();
    const stagingRule = headers.find((rule) =>
      rule.has?.some(
        (cond) => cond.type === 'host' && cond.value === 'stx.schoolcompare.co.uk',
      ),
    );
    expect(stagingRule).toBeDefined();
    expect(stagingRule!.headers).toContainEqual({
      key: 'X-Robots-Tag',
      value: 'noindex, nofollow',
    });
  });

  it('still emits standalone output for the Docker runner', () => {
    expect(nextConfig.output).toBe('standalone');
  });

  it('still traces the share-card fonts into the standalone bundle', () => {
    expect(nextConfig.outputFileTracingIncludes!['/opengraph-image']).toEqual([
      './assets/**',
    ]);
  });

  it('still allows the analytics subdomain to frame the site', async () => {
    const headers = await headerRules();
    const csp = headers
      .flatMap((rule) => rule.headers)
      .find((header) => header.key === 'Content-Security-Policy');
    expect(csp).toBeDefined();
    expect(csp!.value).toContain('https://analytics.schoolcompare.co.uk');
  });
});

describe('admin surface', () => {
  it('serves noindex on the admin panel and the CMS API', async () => {
    // robots.txt disallows these too, but a Disallow only blocks crawling — a
    // URL found from an external link can still be indexed without ever being
    // fetched. This header is what actually keeps them out.
    const headers = await headerRules();
    for (const source of ['/admin/:path*', '/cms-api/:path*']) {
      const rule = headers.find((entry) => entry.source === source);
      expect(rule).toBeDefined();
      expect(rule!.headers).toContainEqual({
        key: 'X-Robots-Tag',
        value: 'noindex, nofollow',
      });
    }
  });
});