www stuff

apps/www/src/test/integration/api.test.ts

@@ -2,6 +2,7 @@ import { SELF } from 'cloudflare:test'
 import { expect, it } from 'vitest'
 
 import { DOCUMENTED_SERVICES } from '../../docs'
+import { DISCORD_INVITE, ISSUES_URL, PRIVACY_EMAIL } from '../../links'
 
 it('rejects unauthenticated account reads', async () => {
 	const res = await SELF.fetch('https://example.com/api/me')
@@ -69,3 +70,31 @@ it('404s a spec proxy for an unknown service (not an open proxy)', async () => {
 	const res = await SELF.fetch('https://example.com/docs/openapi/evil.json')
 	expect(res.status).toBe(404)
 })
+
+// The privacy policy is what the Meta Horizon Store's VRC.Privacy.1–4 checks are run
+// against, and a reviewer only sees the rendered page — so the four things they look
+// for are pinned here. If a section is renamed, re-read the VRC before loosening the
+// assertion: these strings are the requirement, not incidental copy.
+it('serves the privacy policy as real server-rendered HTML', async () => {
+	const res = await SELF.fetch('https://example.com/privacy')
+	// VRC.Privacy.1 — live, public, no sign-in, and text without JavaScript.
+	expect(res.status).toBe(200)
+	expect(res.headers.get('content-type')).toContain('text/html')
+	const html = await res.text()
+	expect(html).toContain('Privacy Policy')
+
+	// VRC.Privacy.2 — what is collected, VRC.Privacy.3 — what it is used for.
+	expect(html).toContain('What we collect')
+	expect(html).toContain('Why we use it')
+
+	// VRC.Privacy.4 — deletion is explained, free, and open to every region.
+	expect(html).toContain('Deleting your data')
+	expect(html).toMatch(/delete your account[^.]*at any\s+time, from anywhere in the world/)
+	expect(html).toContain('There is no charge for this')
+
+	// A deletion route a reader can actually follow. Discord and GitHub are always
+	// listed; the mailbox only when one is configured (see PRIVACY_EMAIL).
+	expect(html).toContain(DISCORD_INVITE)
+	expect(html).toContain(ISSUES_URL)
+	if (PRIVACY_EMAIL) expect(html).toContain(`mailto:${PRIVACY_EMAIL}`)
+})