<?php

it('sends HSTS header on all requests', function () {
    $response = $this->get('/');
    $response->assertHeader('Strict-Transport-Security');
    $response->assertHeader('X-Content-Type-Options', 'nosniff');
    $response->assertHeader('X-Frame-Options', 'DENY');
    $response->assertHeader('Referrer-Policy', 'strict-origin');
    $response->assertHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
});