lab: a forge setting that is not http(s) is never a trusted origin (hq issue 624, review 222)

modules/lab/test/runs.test.ts

@@ -370,3 +370,14 @@ test("the public root is read from the binding, and only an https root at the np
   assert.match(publicRootOf(undefined).problem ?? "", /no npm-package-registry binding/);
   rmSync(dir, { recursive: true, force: true });
 });
+
+// A forge setting that is not http(s) is never a trusted origin (review of #280): a `file:` tarball's origin
+// is "null", as is a `file:` forge's, and the two must not match.
+test("a forge setting that is not http(s) trusts no origin of its own", async () => {
+  const got = await npmRegistry("file:///srv/forge", aRegistry(() => packument("file:///api/packages/novox/npm/x.tgz")).get);
+  assert.match(got.problem ?? "", /neither the forge's public root nor its own address/);
+  const root = "https://git.example.org/api/packages/novox/npm/";
+  const viaRoot = await npmRegistry("ftp://novox.internal", aRegistry(() =>
+    packument("ftp://novox.internal/api/packages/novox/npm/x.tgz")).get, root);
+  assert.match(viaRoot.problem ?? "", /neither/);
+});