اصلاح هدر ها برای نمایش ایفریم

backend/tests/test_platform.py

@@ -235,6 +235,10 @@ VIEWER_CSP = DEFAULT_CSP.replace("frame-ancestors 'none'", "frame-ancestors 'sel
     ('GET', '/view/invalid-id', 404),
     ('GET', '/view/nested/missing', 404),
     ('POST', '/view/' + '0'*48, 405),
+    ('GET', '/compare/' + '0'*48, 200),
+    ('GET', '/compare/invalid-id', 404),
+    ('GET', '/compare/nested/missing', 404),
+    ('POST', '/compare/' + '0'*48, 405),
 ])
 def test_viewer_only_allows_self_and_gitea_frames(client, method, path, expected_status):
     response = client.request(method, path)
@@ -244,14 +248,15 @@ def test_viewer_only_allows_self_and_gitea_frames(client, method, path, expected
     assert response.headers['x-content-type-options'] == 'nosniff'
 
 
-@pytest.mark.parametrize('path', ['/', '/docs', '/healthz', '/assets/viewer.js', '/view', '/viewer/invalid', '/api/v1/schematics/'+'0'*48+'/status'])
+@pytest.mark.parametrize('path', ['/', '/docs', '/healthz', '/assets/viewer.js', '/view', '/compare', '/api/compare/'+'0'*48, '/viewer/invalid', '/api/v1/schematics/'+'0'*48+'/status'])
 def test_non_viewer_keeps_original_csp(client, path):
     response = client.get(path)
     assert response.headers.get_list('content-security-policy') == [DEFAULT_CSP]
 
 
 @pytest.mark.parametrize('frame_option', ['DENY', 'SAMEORIGIN'])
-def test_conflicting_headers_removed_only_for_viewer(client, monkeypatch, frame_option):
+@pytest.mark.parametrize('prefix', ['/view/', '/compare/'])
+def test_conflicting_headers_removed_only_for_viewer(client, monkeypatch, frame_option, prefix):
     from fastapi.responses import Response
     def page(*args, **kwargs):
         response = Response('page', media_type='text/html', headers={
@@ -260,7 +265,8 @@ def test_conflicting_headers_removed_only_for_viewer(client, monkeypatch, frame_
         response.headers.append('Content-Security-Policy', "frame-ancestors 'none'")
         return response
     monkeypatch.setattr('app.main.FileResponse', page)
-    viewer = client.get('/view/'+'0'*48)
+    monkeypatch.setattr('app.compare_api.FileResponse', page)
+    viewer = client.get(prefix+'0'*48)
     assert 'x-frame-options' not in viewer.headers
     assert viewer.headers.get_list('content-security-policy') == [VIEWER_CSP]
     other = client.get('/docs')