Treat progmasoft.com as an HSTS-preloaded domain

.com has no HSTS requirement of its own, but progmasoft.com is served as
if it had one:

- Every HTTPS server block of progmasoft.com, www, account and viget
  sends max-age=63072000; includeSubDomains; preload. The www redirect
  sent none before.
- Plain HTTP only answers the ACME challenge and otherwise redirects to
  HTTPS, now with a permanent 308 instead of 301.
- The API's own HSTS policy, which it adds to HTTPS responses outside
  development, carries the same values, so a proxied response never
  shows two different policies. A test checks the header.

1 files changed, 18 insertions, 0 deletions

diff --git a/apps/api-tests/SecurityHeaderTests.cs b/apps/api-tests/SecurityHeaderTests.cs
index 2d53ecf..e355035 100644
--- a/apps/api-tests/SecurityHeaderTests.cs
+++ b/apps/api-tests/SecurityHeaderTests.cs
@@ -4,6 +4,7 @@
 using System.Net;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.AspNetCore.Mvc.Testing;
 using Progmasoft.Progmaweb.Api.Security;
 
 namespace Progmasoft.Progmaweb.Api.Tests;
@@ -41,4 +42,21 @@ public sealed class SecurityHeaderTests
         Assert.Contains("frame-ancestors 'none'",
             Assert.Single(response.Headers.GetValues("Content-Security-Policy")), StringComparison.Ordinal);
     }
+
+    [Fact]
+    public async Task HttpsResponsesCarryThePreloadPolicyNginxSends()
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+            BaseAddress = new Uri("https://account.progmasoft.com"),
+        });
+
+        HttpResponseMessage response =
+            await client.GetAsync("/api/v1/status", TestContext.Current.CancellationToken);
+
+        Assert.Equal("max-age=63072000; includeSubDomains; preload",
+            Assert.Single(response.Headers.GetValues("Strict-Transport-Security")));
+    }
 }