package credits

import (
	"bytes"
	"html/template"
	"strings"
	"testing"
)

func TestNoticesAreEscapedAndNeedNoScript(t *testing.T) {
	tpl, err := template.ParseFS(Templates(), "templates/*.html")
	if err != nil {
		t.Fatal(err)
	}
	notice := "Copyright <script>alert(1)</script>\nPermission & conditions"
	data := PageData{Title: "Open source", Components: []Component{{Name: "<img src=x onerror=alert(1)>", Version: "v1.2.3", SourceURL: "https://example.org/source", Notices: []Notice{{Name: "LICENSE", Text: notice}}}}}
	var out bytes.Buffer
	if err := tpl.ExecuteTemplate(&out, "estilo/credits", data); err != nil {
		t.Fatal(err)
	}
	html := out.String()
	if strings.Contains(html, "<script") || strings.Contains(html, "<img") || !strings.Contains(html, "<details>") || !strings.Contains(html, "&lt;script&gt;") || !strings.Contains(html, "Permission &amp; conditions") {
		t.Fatal("notices were interpreted as markup or lost")
	}
	data.Components[0].SourceURL = "javascript:alert(1)"
	out.Reset()
	if err := tpl.ExecuteTemplate(&out, "estilo/credits", data); err != nil {
		t.Fatal(err)
	}
	if strings.Contains(out.String(), `href="javascript:`) {
		t.Fatal("unsafe source URL reached link")
	}
}

func TestCallerSuppliesLocalizedTitleAndNoticesRemainOriginal(t *testing.T) {
	tpl, err := template.ParseFS(Templates(), "templates/*.html")
	if err != nil {
		t.Fatal(err)
	}
	// The component has no translated strings of its own. Even a right-to-left
	// title leaves package identifiers isolated and notice text unchanged.
	for _, title := range []string{"Open source", "Foinse oscailte", "Código abierto", "Code source ouvert", "Código aberto", "Open source-software", "Openbronsoftware", "Codice aperto", "Kod źródłowy", "Öppen källkod", "オープンソース", "المصدر المفتوح"} {
		var out bytes.Buffer
		if err := tpl.ExecuteTemplate(&out, "estilo/credits", PageData{Title: title, Components: []Component{{Name: "example/module", Notices: []Notice{{Name: "LICENSE", Text: "Original notice"}}}}}); err != nil {
			t.Fatal(err)
		}
		if !strings.Contains(out.String(), title) || !strings.Contains(out.String(), "Original notice") || !strings.Contains(out.String(), "<bdi>example/module</bdi>") {
			t.Fatal("localized title or original notice lost")
		}
	}
}

func TestNoticeFormattingAndMissingLabel(t *testing.T) {
	tpl := template.Must(template.ParseFS(Templates(), "templates/*.html"))
	var out bytes.Buffer
	data := PageData{Title: "Credits", MissingNoticeLabel: "<missing>", Components: []Component{{Name: "first", Notices: []Notice{{Name: "LICENSE", Text: "\nOriginal notice"}}}, {Name: "second"}}}
	if err := tpl.ExecuteTemplate(&out, "estilo/credits", data); err != nil {
		t.Fatal(err)
	}
	html := out.String()
	if !strings.Contains(html, "<pre>\n\nOriginal notice</pre>") {
		t.Fatal("HTML parser would remove original first newline")
	}
	if strings.Contains(html, "<h2>") {
		t.Fatal("notice filename became an unowned heading")
	}
	if strings.Count(html, "&lt;missing&gt;") != 1 || strings.Contains(html, "<missing>") {
		t.Fatal("missing-notice label lost, repeated or interpreted")
	}
}