package docs_test

import (
	"net/http"
	"strings"
	"testing"

	"github.com/carlosframework/docs/internal/docs"
)

// A reader grantee must not be handed an editor. Found by the branch
// review, and the worst defect on this branch: `show` used GetFor
// (correct — a reader may read) and then rendered the owner's page
// verbatim, so ProseMirror mounted, the toolbar enabled, and the document
// became contenteditable for somebody the server will refuse.
//
// The server refusal was never in doubt: ApplyUpdate returns ErrNotWritable
// and updatesPost answers 404. The damage is upstream of that. The browser
// has already taken the keystrokes; the save queue classifies the 404 as
// permanent, drops the batch, and keeps accepting typing. The person is
// told "save failed" after writing a paragraph into a page that told them
// they could.
//
// "It fails safely on the server" is not a defence when the cost is a
// person's work.
func TestAReaderIsNotGivenAnEditor(t *testing.T) {
	app, _ := docs.NewForTest(t)
	alice := signInCookies(t, app, "alice@example.com")
	sqid := createDoc(t, app, alice, "Minutes")
	bob := signInCookies(t, app, "bob@example.com")
	post(t, app, alice, "/d/"+sqid+"/share", "address=bob@example.com&role=reader")

	rec := get(t, app, bob, "/d/"+sqid)
	if rec.Code != http.StatusOK {
		t.Fatalf("GET /d/%s as a reader: status %d, want 200", sqid, rec.Code)
	}
	body := rec.Body.String()

	// The mount ELEMENT, not the string: `[docs-editor]` also appears a
	// dozen times in this page's own <style> block, so banning the bare
	// word would fail on a page that is perfectly correct — and would
	// have hidden whether the element itself was gone. `docs-text
	// docs-editor` is the attribute pair the mount point carries and the
	// stylesheet never does.
	//
	// data-sqid is the bundle's only way to learn where to post, and the
	// editor script is checked by its real served path rather than a
	// guessed substring: the review found this test's earlier sibling
	// banning "editor-entry", a string that appears on no page in this
	// app, which is a ban that could never fail.
	for _, banned := range []string{"docs-text docs-editor", "data-sqid", docs.TestEditorScriptPath()} {
		if strings.Contains(body, banned) {
			t.Errorf("a reader's document page ships %q", banned)
		}
	}

	// The content is still there. A read-only page that renders nothing is
	// not the fix.
	if !strings.Contains(body, "Minutes") {
		t.Error("the reader's page does not show the document")
	}
}

// The writer keeps everything. Without this the fix above passes on a
// page that gives nobody an editor.
func TestAWriterKeepsTheEditor(t *testing.T) {
	app, _ := docs.NewForTest(t)
	alice := signInCookies(t, app, "alice@example.com")
	sqid := createDoc(t, app, alice, "Minutes")
	bob := signInCookies(t, app, "bob@example.com")
	post(t, app, alice, "/d/"+sqid+"/share", "address=bob@example.com&role=writer")

	for who, cookies := range map[string][]*http.Cookie{"writer": bob, "owner": alice} {
		body := get(t, app, cookies, "/d/"+sqid).Body.String()
		for _, needed := range []string{"docs-text docs-editor", "data-sqid", docs.TestEditorScriptPath()} {
			if !strings.Contains(body, needed) {
				t.Errorf("the %s's page is missing %q", who, needed)
			}
		}
	}
}