fix: resolve workspace integration blockers (#5)

tests/cad-input-policy.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import {
+  assertCadByteLength,
+  resolveCadUrl,
+} from '../apps/viewer-2d-sample/src/cadInputPolicy';
+
+describe('CAD input policy', () => {
+  it('accepts same-origin URLs and rejects cross-origin model URLs', () => {
+    expect(resolveCadUrl('/samples/simple.dxf', new URL('https://viewer.example/app/')).href).toBe(
+      'https://viewer.example/samples/simple.dxf',
+    );
+    expect(() =>
+      resolveCadUrl('https://attacker.example/oversized.dxf', new URL('https://viewer.example/')),
+    ).toThrow('같은 origin');
+  });
+
+  it('rejects CAD input larger than 50 MiB', () => {
+    expect(() => assertCadByteLength(50 * 1024 * 1024)).not.toThrow();
+    expect(() => assertCadByteLength(50 * 1024 * 1024 + 1)).toThrow('50 MiB');
+  });
+});