Support couchapp attachments

etc/local.ini

@@ -5,6 +5,12 @@ enable_cors = true
 origins = *
 credentials = true
 
+[csp]
+attachments_enable = true
+; https://docs.couchdb.org/en/stable/cve/2021-38295.html
+; use nginx instead to allow only signed couchapps when on deployed server
+attachments_header_value = "child-src 'self' data: blob:; default-src 'self'; img-src 'self' data: https://secure.gravatar.com; font-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
+
 [couchdb]
 single_node=true
 

nyc.config.js

@@ -7,7 +7,7 @@ module.exports = {
   ],
   'check-coverage': true,
   branches: 65,
-  functions: 66,
+  functions: 65,
   lines: 76,
   statements: 76,
   reporter: ['text', 'lcov'],

test/integration/install.js

@@ -18,6 +18,8 @@ debug('replay localhosts', replay._localhosts);
              \"TLS server: In state wait_finished received CLIENT ALERT: Fatal - Certificate Unknown\\n\"}}}"
  */
 let destination = 'http://admin:none@localhost:5984';
+const couchUrl = destination.replace('admin:none@', '');
+
 if (!destination) {
   destination = url.parse(config.usersDbConnection.url);
   destination.auth = `${config.couchKeys.username}:${config.couchKeys.password}`;
@@ -525,19 +527,39 @@ describe('install', () => {
           expect(res.body.ok).to.equal(true);
 
           return supertest(destination)
+            .put(`/${dbnameToReplicate}/_security`)
+            .set('cookie', adminSessionCookie)
+            .set('Accept', 'application/json')
+            .send({
+              // The couchapp is public but only admins can write to it
+              members: { roles: [] },
+              admins: { roles: ["_admin"] },
+            });
+        })
+        .then((res) => {
+          expect(res.body.ok).to.equal(true);
+
+          return supertest(couchUrl)
             .get(`/${dbnameToReplicate}/_design/prototype`)
             .set('Accept', 'application/json');
         })
         .then((res) => {
           debug('res.body prototype after ', res.body);
           expect(res.body.couchapp && res.body.couchapp.name).to.contain('Prototype (has the most features of the apps)', JSON.stringify(res.body));
 
-          return supertest(destination)
+          return supertest(couchUrl)
             .get(`/${dbnameToReplicate}/_design/prototype/user.html`);
         })
         .then((res) => {
           debug('res.body prototype after ', res.body);
           expect(res.status).to.equal(200);
+
+          return supertest(couchUrl)
+            .get(`/${dbnameToReplicate}/_design/prototype/app/app.css`);
+        })
+        .then((res) => {
+          debug('attachments prototype after ', res.body);
+          expect(res.status).to.equal(200);
         });
     });
   });