verdande/internal/httpapi/shell_test.go

package httpapi

import (
	"io"
	"io/fs"
	"log/slog"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"testing/fstest"
	"time"

	"github.com/kristianwind/verdande/internal/config"
	"github.com/kristianwind/verdande/internal/store"
)

// serverWithWeb builds the real router around a frontend, which newTestServerWith
// cannot do — it passes nil for the web filesystem, because every other test here
// is about the API. The renaming only happens when there is something to rename.
func serverWithWeb(t *testing.T, edition string, web fs.FS) *Server {
	t.Helper()

	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
	if err != nil {
		t.Fatalf("open db: %v", err)
	}
	t.Cleanup(func() { db.Close() })

	cfg := &config.Config{
		BaseURL:    "http://localhost",
		DataDir:    t.TempDir(),
		SessionTTL: 24 * time.Hour,
		Edition:    edition,
	}
	return New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), web)
}

// The shell as the frontend build produces it, cut down to the parts that matter
// here: the two anchors that get renamed, and the inline theme script that must
// not be touched. TestAppHTMLStillCarriesTheAnchors below is what keeps this
// honest against the real file.
const builtShell = `<!doctype html>
<html lang="da" data-theme="dark">
	<head>
		<meta name="description" content="verdande — opgaver og projekter, delt." />
		<link rel="manifest" href="/manifest.webmanifest" />
		<title>verdande</title>
		<script>
			try {
				const stored = localStorage.getItem('verdande:theme');
				const look = localStorage.getItem('verdande:look');
				if (look && look !== 'verdande') document.documentElement.dataset.look = look;
			} catch (e) {}
		</script>
	</head>
	<body></body>
</html>
`

const builtManifest = `{
  "name": "verdande",
  "short_name": "verdande",
  "description": "Opgaver og projekter, delt.",
  "start_url": "/"
}
`

func builtWeb() fstest.MapFS {
	return fstest.MapFS{
		"index.html":            {Data: []byte(builtShell)},
		"manifest.webmanifest":  {Data: []byte(builtManifest)},
		"_app/immutable/app.js": {Data: []byte("// app")},
	}
}

// TestRenamingTheShellLeavesTheStorageKeysAlone is the one this file exists for.
//
// The product name and the localStorage prefix are the same word in app.html, and
// they are not the same thing: the prefix is read back by the app itself, so
// renaming it here and nowhere else sets the theme from one key and reads it from
// another. The symptom is the white flash on load that the inline script exists to
// prevent — which is to say, no error, nothing in a log, and nothing a test that
// merely checked the title would see.
func TestRenamingTheShellLeavesTheStorageKeysAlone(t *testing.T) {
	shell, manifest, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
	if err != nil {
		t.Fatalf("rebrandedAssets: %v", err)
	}

	got := string(shell)
	for _, want := range []string{
		"<title>urd</title>",
		`content="urd — noter, delt."`,
	} {
		if !strings.Contains(got, want) {
			t.Errorf("the shell does not contain %q", want)
		}
	}
	// Named values rather than "no occurrences of verdande": the three keys are
	// what has to survive, so the assertion says the three keys.
	for _, want := range []string{
		`localStorage.getItem('verdande:theme')`,
		`localStorage.getItem('verdande:look')`,
		`look !== 'verdande'`,
	} {
		if !strings.Contains(got, want) {
			t.Errorf("renaming the shell changed a storage key: %q is gone", want)
		}
	}
	if strings.Contains(got, "urd:theme") || strings.Contains(got, "urd:look") {
		t.Error("renaming the shell rewrote a localStorage prefix; the app reads the verdande: ones")
	}

	gotManifest := string(manifest)
	for _, want := range []string{`"name": "urd"`, `"short_name": "urd"`, `"description": "Noter, delt."`} {
		if !strings.Contains(gotManifest, want) {
			t.Errorf("the manifest does not contain %q", want)
		}
	}
}

// TestRenamingTheShellKeepsTheCSPHashValid pins the relationship between the two
// files that is easy to break and impossible to notice: the policy names a hash of
// the inline script, and the renamed shell is what gets served. If a replacement
// ever reached inside the <script>, the hash would change, the browser would refuse
// to run it, and the page would be blank — in production only, because the policy
// is not enforced for a page opened from a file.
func TestRenamingTheShellKeepsTheCSPHashValid(t *testing.T) {
	shell, _, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
	if err != nil {
		t.Fatalf("rebrandedAssets: %v", err)
	}

	before := scriptHashesIn([]byte(builtShell))
	after := scriptHashesIn(shell)
	if len(before) != 1 {
		t.Fatalf("the fixture should have exactly one inline script, found %d", len(before))
	}
	if len(after) != len(before) || after[0] != before[0] {
		t.Errorf("renaming changed the inline script: policy had %v, served shell hashes to %v", before, after)
	}
}

// TestRenamingRefusesAMissingAnchor is the direction that matters more than the
// happy path. A replacement that silently matched nothing leaves an Urd instance
// calling itself verdande, which is cosmetic enough that nobody reports it — so the
// rewrite has to say so rather than return what it managed.
func TestRenamingRefusesAMissingAnchor(t *testing.T) {
	cases := map[string]fstest.MapFS{
		"no title": {
			"index.html":           {Data: []byte(strings.Replace(builtShell, "<title>verdande</title>", "<title>something else</title>", 1))},
			"manifest.webmanifest": {Data: []byte(builtManifest)},
		},
		"no description": {
			"index.html":           {Data: []byte(strings.Replace(builtShell, `content="verdande — opgaver og projekter, delt."`, `content="other"`, 1))},
			"manifest.webmanifest": {Data: []byte(builtManifest)},
		},
		"no manifest name": {
			"index.html":           {Data: []byte(builtShell)},
			"manifest.webmanifest": {Data: []byte(strings.Replace(builtManifest, `"name": "verdande"`, `"name": "other"`, 1))},
		},
		"no index.html at all": {
			"manifest.webmanifest": {Data: []byte(builtManifest)},
		},
		"no manifest at all": {
			"index.html": {Data: []byte(builtShell)},
		},
	}
	for name, web := range cases {
		t.Run(name, func(t *testing.T) {
			if _, _, err := rebrandedAssets(web, "urd", "d", "m"); err == nil {
				t.Error("renaming reported success over a shell it could not rename")
			}
		})
	}
}

// TestAppHTMLStillCarriesTheAnchors is what stops the fixture above from becoming a
// frozen copy of a file that has moved on.
//
// The anchors are exact strings in web/src/app.html, and that file is edited for
// unrelated reasons — a meta tag, a new theme attribute. An edit that reformats the
// title line or rewrites the description breaks the rename and nothing in Go would
// know, because the Go build graph has never heard of app.html.
//
// Note the caching trap that comes with reading a non-Go file from a test: `go
// test` will serve a cached green over a changed app.html. CI passes -count=1 in
// both workflows; a local run needs it typed.
func TestAppHTMLStillCarriesTheAnchors(t *testing.T) {
	raw, err := os.ReadFile("../../web/src/app.html")
	if err != nil {
		t.Skipf("app.html is not reachable from here: %v", err)
	}
	src := string(raw)

	for _, pair := range shellRebrands("urd", "d") {
		if n := strings.Count(src, pair.old); n != 1 {
			t.Errorf("web/src/app.html contains %d occurrences of the anchor %q, want exactly 1 — "+
				"the notes edition renames the shell by replacing it", n, pair.old)
		}
	}
	// And the keys the rename must not touch, asserted here too: app.html is where
	// somebody would rename them, and if they are renamed there they must be
	// renamed in stores.svelte.js in the same commit.
	if !strings.Contains(src, `localStorage.getItem('verdande:theme')`) {
		t.Error("web/src/app.html no longer reads verdande:theme; check that the app reads the same key")
	}
	t.Logf("app.html: %d bytes, %d anchors found", len(raw), len(shellRebrands("urd", "d")))
}

// TestTheFullEditionServesTheBuiltFilesUnchanged is the control. Everything above
// is about the renamed path; this says the other edition does not go through it.
func TestTheFullEditionServesTheBuiltFilesUnchanged(t *testing.T) {
	for _, edition := range []string{"full", "notes"} {
		t.Run(edition, func(t *testing.T) {
			srv := serverWithWeb(t, edition, builtWeb())
			if edition == "full" {
				if srv.renamed("index.html") != nil || srv.renamed("manifest.webmanifest") != nil {
					t.Error("the full edition renamed the shell")
				}
				return
			}
			if srv.renamed("index.html") == nil || srv.renamed("manifest.webmanifest") == nil {
				t.Fatal("the notes edition did not rename the shell")
			}
			if !strings.Contains(string(srv.renamed("index.html")), "<title>urd</title>") {
				t.Error("the notes edition's shell does not say urd")
			}
			if srv.renamed("_app/immutable/app.js") != nil {
				t.Error("a build asset was served from memory; only the shell and the manifest are renamed")
			}
		})
	}
}