feat(ads/seo/release): v1.2.0 with live Google Ads, isolated ad profile, ads.txt, and SEO/AEO/GEO optimization

tests/Paca.Tests/Browser/ChromeExtensionCspValidatorTests.cs

@@ -0,0 +1,48 @@
+using System.Linq;
+using Paca.Browser.Extensions;
+using Xunit;
+
+namespace Paca.Tests.Browser;
+
+public class ChromeExtensionCspValidatorTests
+{
+    [Fact]
+    public void ValidateManifestCsp_Allows_Safe_Self_Policy()
+    {
+        var safeCsp = "script-src 'self'; object-src 'self';";
+        var result = ExtensionCspValidator.Validate(safeCsp, manifestVersion: 3);
+
+        Assert.True(result.IsValid);
+        Assert.Empty(result.Violations);
+        Assert.Equal("script-src 'self'; object-src 'self';", result.NormalizedCsp);
+    }
+
+    [Fact]
+    public void ValidateManifestCsp_Rejects_UnsafeEval_In_ManifestV3()
+    {
+        var evalCsp = "script-src 'self' 'unsafe-eval'; object-src 'self';";
+        var result = ExtensionCspValidator.Validate(evalCsp, manifestVersion: 3);
+
+        Assert.False(result.IsValid);
+        Assert.Contains(result.Violations, v => v.Contains("'unsafe-eval'"));
+    }
+
+    [Fact]
+    public void ValidateManifestCsp_Rejects_Remote_Script_Sources_In_ManifestV3()
+    {
+        var remoteCsp = "script-src 'self' https://cdn.jsdelivr.net; object-src 'none';";
+        var result = ExtensionCspValidator.Validate(remoteCsp, manifestVersion: 3);
+
+        Assert.False(result.IsValid);
+        Assert.Contains(result.Violations, v => v.Contains("remote script"));
+    }
+
+    [Fact]
+    public void ValidateManifestCsp_Provides_Default_When_Null_Or_Empty()
+    {
+        var result = ExtensionCspValidator.Validate(null, manifestVersion: 3);
+
+        Assert.True(result.IsValid);
+        Assert.Equal(ExtensionCspValidator.DefaultManifestV3Csp, result.NormalizedCsp);
+    }
+}