package ui

import (
	"io/fs"
	"regexp"
	"strings"
	"testing"
)

// The server ships a CSP of script-src 'self'; style-src 'self' with no
// unsafe-inline. Assets that grow an inline script, an inline <style>, or a
// style= attribute would silently stop rendering in the browser, so guard the
// invariant here rather than discovering it in production.
func TestShippedAssetsCarryNothingInline(t *testing.T) {
	banned := []struct {
		what string
		re   *regexp.Regexp
	}{
		{"inline <style> block", regexp.MustCompile(`(?is)<style[\s>]`)},
		{"style= attribute", regexp.MustCompile(`(?i)\sstyle\s*=`)},
		{"inline event handler", regexp.MustCompile(`(?i)\son(?:click|load|error|submit|change|input|keydown)\s*=`)},
	}
	scriptBody := regexp.MustCompile(`(?is)<script[^>]*>(.*?)</script>`)

	assets := Assets()
	err := fs.WalkDir(assets, ".", func(p string, d fs.DirEntry, err error) error {
		if err != nil || d.IsDir() || !strings.HasSuffix(p, ".html") {
			return err
		}
		b, err := fs.ReadFile(assets, p)
		if err != nil {
			return err
		}
		for _, ban := range banned {
			if ban.re.Match(b) {
				t.Errorf("%s contains an %s, which the CSP forbids", p, ban.what)
			}
		}
		for _, m := range scriptBody.FindAllSubmatch(b, -1) {
			if len(strings.TrimSpace(string(m[1]))) > 0 {
				t.Errorf("%s contains an inline <script> body, which the CSP forbids", p)
			}
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
}

// The favicon is a data: URI, which is why img-src carries data:. If it ever
// stops being one, img-src should tighten back to 'self'.
func TestFaviconIsTheOnlyDataURI(t *testing.T) {
	b, err := fs.ReadFile(Assets(), "index.html")
	if err != nil {
		t.Fatal(err)
	}
	for _, line := range strings.Split(string(b), "\n") {
		if !strings.Contains(line, "data:") {
			continue
		}
		if !strings.Contains(line, `rel="icon"`) {
			t.Errorf("unexpected data: URI outside the favicon: %s", strings.TrimSpace(line))
		}
	}
}