package homeconnect

import (
	"bytes"
	"html/template"
	"strings"
	"testing"
)

func render(t *testing.T, name string, data any) string {
	t.Helper()
	view, err := template.New("view").ParseFS(Templates(), "templates/*.html")
	if err != nil {
		t.Fatal(err)
	}
	var out bytes.Buffer
	if err := view.ExecuteTemplate(&out, name, data); err != nil {
		t.Fatal(err)
	}
	return out.String()
}

func TestCallerTranslationsAndScriptlessActions(t *testing.T) {
	labels := map[string]string{"en": "Continue", "de": "Weiter", "es": "Continuar", "fr": "Continuer", "it": "Continua", "pt": "Continuar", "nl": "Doorgaan", "pl": "Kontynuuj", "ar": "متابعة", "ja": "続行", "zh": "继续", "ko": "계속"}
	for locale, label := range labels {
		t.Run(locale, func(t *testing.T) {
			data := PageData{Title: label, Body: label, Address: "person@example.test", Action: "/account/home", ActionLabel: label, CancelLabel: label, PostAction: true}
			html := render(t, "home-connect", data)
			for _, want := range []string{label, `method="post" action="/account/home"`, `<bdi>person@example.test</bdi>`, `rst-btn="ghost"`} {
				if !strings.Contains(html, want) {
					t.Fatalf("missing %q", want)
				}
			}
			if strings.Contains(html, "<script") {
				t.Fatal("connection action requires script")
			}
			data.PostAction = false
			if html = render(t, "home-connect", data); strings.Contains(html, "<form") || !strings.Contains(html, `href="/account/home"`) {
				t.Fatal("navigation action is not a link")
			}
		})
	}
}
func TestUntrustedTextAndDestinationAreEscaped(t *testing.T) {
	html := render(t, "home-connect", PageData{Title: `<script>bad</script>`, Address: `<img src=x onerror=bad>`, Action: "javascript:bad", ActionLabel: "Go"})
	if strings.Contains(html, "<script>") || strings.Contains(html, "<img") || !strings.Contains(html, "#ZgotmplZ") {
		t.Fatal("unsafe connection markup", html)
	}
}
func TestOAuthHeadAndBodyRetainValidatedDestination(t *testing.T) {
	d := OAuthData{URL: "https://keymail.example.test/oauth/authorize?state=test&client_id=app", Title: "Continue", ActionLabel: "Continue"}
	head, body := render(t, "home-oauth-head", d), render(t, "home-oauth", d)
	if !strings.Contains(head, `http-equiv="refresh"`) || !strings.Contains(head, "keymail.example.test/oauth/authorize") || !strings.Contains(body, `href="https://keymail.example.test/oauth/authorize?state=test&amp;client_id=app"`) {
		t.Fatal("scriptless OAuth continuation missing", head, body)
	}
}