verdande/internal/httpapi/shell_test.go

package httpapi

import (
	"encoding/json"
	"io"
	"io/fs"
	"log/slog"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"testing/fstest"
	"time"

	"github.com/kristianwind/verdande/internal/config"
	"github.com/kristianwind/verdande/internal/store"
)

// serverWithWeb builds the real router around a frontend, which newTestServerWith
// cannot do — it passes nil for the web filesystem, because every other test here
// is about the API. The renaming only happens when there is something to rename.
func serverWithWeb(t *testing.T, edition string, web fs.FS) *Server {
	t.Helper()

	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
	if err != nil {
		t.Fatalf("open db: %v", err)
	}
	t.Cleanup(func() { db.Close() })

	cfg := &config.Config{
		BaseURL:    "http://localhost",
		DataDir:    t.TempDir(),
		SessionTTL: 24 * time.Hour,
		Edition:    edition,
	}
	return New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), web)
}

// The shell as the frontend build produces it, cut down to the parts that matter
// here: the two anchors that get renamed, and the inline theme script that must
// not be touched. TestAppHTMLStillCarriesTheAnchors below is what keeps this
// honest against the real file.
const builtShell = `<!doctype html>
<html lang="da" data-theme="dark">
	<head>
		<meta name="description" content="verdande — opgaver og projekter, delt." />
		<link rel="manifest" href="/manifest.webmanifest" />
		<link rel="icon" href="/icon.svg" type="image/svg+xml" />
		<link rel="apple-touch-icon" href="/apple-touch-icon.png" />
		<title>verdande</title>
		<script>
			try {
				const stored = localStorage.getItem('verdande:theme');
				const look = localStorage.getItem('verdande:look');
				if (look && look !== 'verdande') document.documentElement.dataset.look = look;
			} catch (e) {}
		</script>
	</head>
	<body></body>
</html>
`

const builtManifest = `{
  "name": "verdande",
  "short_name": "verdande",
  "description": "Opgaver og projekter, delt.",
  "start_url": "/",
  "display": "standalone",
  "background_color": "#111312",
  "theme_color": "#111312",
  "lang": "da",
  "icons": [
    { "src": "/icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any" },
    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
  ]
}
`

func builtWeb() fstest.MapFS {
	return fstest.MapFS{
		"index.html":            {Data: []byte(builtShell)},
		"manifest.webmanifest":  {Data: []byte(builtManifest)},
		"_app/immutable/app.js": {Data: []byte("// app")},
	}
}

// TestRenamingTheShellLeavesTheStorageKeysAlone is the one this file exists for.
//
// The product name and the localStorage prefix are the same word in app.html, and
// they are not the same thing: the prefix is read back by the app itself, so
// renaming it here and nowhere else sets the theme from one key and reads it from
// another. The symptom is the white flash on load that the inline script exists to
// prevent — which is to say, no error, nothing in a log, and nothing a test that
// merely checked the title would see.
func TestRenamingTheShellLeavesTheStorageKeysAlone(t *testing.T) {
	shell, manifest, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
	if err != nil {
		t.Fatalf("rebrandedAssets: %v", err)
	}

	got := string(shell)
	for _, want := range []string{
		"<title>urd</title>",
		`content="urd — noter, delt."`,
	} {
		if !strings.Contains(got, want) {
			t.Errorf("the shell does not contain %q", want)
		}
	}
	// Named values rather than "no occurrences of verdande": the three keys are
	// what has to survive, so the assertion says the three keys.
	for _, want := range []string{
		`localStorage.getItem('verdande:theme')`,
		`localStorage.getItem('verdande:look')`,
		`look !== 'verdande'`,
	} {
		if !strings.Contains(got, want) {
			t.Errorf("renaming the shell changed a storage key: %q is gone", want)
		}
	}
	if strings.Contains(got, "urd:theme") || strings.Contains(got, "urd:look") {
		t.Error("renaming the shell rewrote a localStorage prefix; the app reads the verdande: ones")
	}

	gotManifest := string(manifest)
	for _, want := range []string{`"name": "urd"`, `"short_name": "urd"`, `"description": "Noter, delt."`} {
		if !strings.Contains(gotManifest, want) {
			t.Errorf("the manifest does not contain %q", want)
		}
	}
}

// TestRenamingTheShellKeepsTheCSPHashValid pins the relationship between the two
// files that is easy to break and impossible to notice: the policy names a hash of
// the inline script, and the renamed shell is what gets served. If a replacement
// ever reached inside the <script>, the hash would change, the browser would refuse
// to run it, and the page would be blank — in production only, because the policy
// is not enforced for a page opened from a file.
func TestRenamingTheShellKeepsTheCSPHashValid(t *testing.T) {
	shell, _, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
	if err != nil {
		t.Fatalf("rebrandedAssets: %v", err)
	}

	before := scriptHashesIn([]byte(builtShell))
	after := scriptHashesIn(shell)
	if len(before) != 1 {
		t.Fatalf("the fixture should have exactly one inline script, found %d", len(before))
	}
	if len(after) != len(before) || after[0] != before[0] {
		t.Errorf("renaming changed the inline script: policy had %v, served shell hashes to %v", before, after)
	}
}

// TestRenamingRefusesAMissingAnchor is the direction that matters more than the
// happy path. A replacement that silently matched nothing leaves an Urd instance
// calling itself verdande, which is cosmetic enough that nobody reports it — so the
// rewrite has to say so rather than return what it managed.
func TestRenamingRefusesAMissingAnchor(t *testing.T) {
	cases := map[string]fstest.MapFS{
		"no title": {
			"index.html":           {Data: []byte(strings.Replace(builtShell, "<title>verdande</title>", "<title>something else</title>", 1))},
			"manifest.webmanifest": {Data: []byte(builtManifest)},
		},
		"no description": {
			"index.html":           {Data: []byte(strings.Replace(builtShell, `content="verdande — opgaver og projekter, delt."`, `content="other"`, 1))},
			"manifest.webmanifest": {Data: []byte(builtManifest)},
		},
		"no manifest name": {
			"index.html":           {Data: []byte(builtShell)},
			"manifest.webmanifest": {Data: []byte(strings.Replace(builtManifest, `"name": "verdande"`, `"name": "other"`, 1))},
		},
		"no index.html at all": {
			"manifest.webmanifest": {Data: []byte(builtManifest)},
		},
		"no manifest at all": {
			"index.html": {Data: []byte(builtShell)},
		},
	}
	for name, web := range cases {
		t.Run(name, func(t *testing.T) {
			if _, _, err := rebrandedAssets(web, "urd", "d", "m"); err == nil {
				t.Error("renaming reported success over a shell it could not rename")
			}
		})
	}
}

// TestAppHTMLStillCarriesTheAnchors is what stops the fixture above from becoming a
// frozen copy of a file that has moved on.
//
// The anchors are exact strings in web/src/app.html, and that file is edited for
// unrelated reasons — a meta tag, a new theme attribute. An edit that reformats the
// title line or rewrites the description breaks the rename and nothing in Go would
// know, because the Go build graph has never heard of app.html.
//
// Note the caching trap that comes with reading a non-Go file from a test: `go
// test` will serve a cached green over a changed app.html. CI passes -count=1 in
// both workflows; a local run needs it typed.
func TestAppHTMLStillCarriesTheAnchors(t *testing.T) {
	raw, err := os.ReadFile("../../web/src/app.html")
	if err != nil {
		t.Skipf("app.html is not reachable from here: %v", err)
	}
	src := string(raw)

	// Both sets: the edition's rename and the second door's. The door was added
	// after this test and its anchors were NOT covered, which is how its fixture
	// came to be missing two <link> lines the real file has — caught only because
	// applyRebrands refuses an anchor it cannot find.
	for what, pairs := range map[string][]rebrand{
		"the notes edition's rename": shellRebrands("urd", "d"),
		"the urd door":               urdShellRebrands(),
	} {
		for _, pair := range pairs {
			if n := strings.Count(src, pair.old); n != 1 {
				t.Errorf("web/src/app.html contains %d occurrences of the anchor %q, want exactly 1 — %s replaces it",
					n, pair.old, what)
			}
		}
	}
	// And the keys the rename must not touch, asserted here too: app.html is where
	// somebody would rename them, and if they are renamed there they must be
	// renamed in stores.svelte.js in the same commit.
	if !strings.Contains(src, `localStorage.getItem('verdande:theme')`) {
		t.Error("web/src/app.html no longer reads verdande:theme; check that the app reads the same key")
	}
	t.Logf("app.html: %d bytes, %d edition anchors, %d door anchors",
		len(raw), len(shellRebrands("urd", "d")), len(urdShellRebrands()))
}

// TestTheFullEditionServesTheBuiltFilesUnchanged is the control. Everything above
// is about the renamed path; this says the other edition does not go through it.
func TestTheFullEditionServesTheBuiltFilesUnchanged(t *testing.T) {
	for _, edition := range []string{"full", "notes"} {
		t.Run(edition, func(t *testing.T) {
			srv := serverWithWeb(t, edition, builtWeb())
			if edition == "full" {
				if srv.renamed("index.html") != nil || srv.renamed("manifest.webmanifest") != nil {
					t.Error("the full edition renamed the shell")
				}
				return
			}
			if srv.renamed("index.html") == nil || srv.renamed("manifest.webmanifest") == nil {
				t.Fatal("the notes edition did not rename the shell")
			}
			if !strings.Contains(string(srv.renamed("index.html")), "<title>urd</title>") {
				t.Error("the notes edition's shell does not say urd")
			}
			if srv.renamed("_app/immutable/app.js") != nil {
				t.Error("a build asset was served from memory; only the shell and the manifest are renamed")
			}
		})
	}
}

// webWithIcons is builtWeb plus both editions' icons, as a real build has them.
func webWithIcons() fstest.MapFS {
	web := builtWeb()
	for _, name := range []string{
		"icon.svg", "icon-192.png", "icon-512.png", "apple-touch-icon.png",
		"urd-icon.svg", "urd-icon-192.png", "urd-icon-512.png", "urd-apple-touch-icon.png",
	} {
		web[name] = &fstest.MapFile{Data: []byte("bytes of " + name)}
	}
	return web
}

// TestEachEditionServesItsOwnMark.
//
// Four paths, named one by one rather than counted: the favicon in app.html, the
// manifest's two, and the one Safari looks for by name. The last is the reason
// this is an alias rather than a rewritten manifest — Safari does not read the
// manifest at all.
func TestEachEditionServesItsOwnMark(t *testing.T) {
	for _, tc := range []struct {
		edition string
		want    map[string]string
	}{
		{"notes", map[string]string{
			"icon.svg":             "urd-icon.svg",
			"icon-192.png":         "urd-icon-192.png",
			"icon-512.png":         "urd-icon-512.png",
			"apple-touch-icon.png": "urd-apple-touch-icon.png",
		}},
		// The control, and it is the half that stops this being a swap rather than
		// a choice: the full edition must resolve nothing.
		{"full", map[string]string{}},
	} {
		t.Run(tc.edition, func(t *testing.T) {
			srv := serverWithWeb(t, tc.edition, webWithIcons())
			if len(srv.assets) != len(tc.want) {
				t.Errorf("%s edition aliases %d paths, want %d: %v", tc.edition, len(srv.assets), len(tc.want), srv.assets)
			}
			for path, alias := range tc.want {
				if srv.assets[path] != alias {
					t.Errorf("%s: %s resolves to %q, want %q", tc.edition, path, srv.assets[path], alias)
				}
			}
			// And nothing else: an alias on a build asset would serve one file's
			// bytes under another's hashed, immutable name.
			for path := range srv.assets {
				if _, ok := tc.want[path]; !ok {
					t.Errorf("%s edition aliases %s, which is not an icon", tc.edition, path)
				}
			}
			t.Logf("%s: %d aliased paths", tc.edition, len(srv.assets))
		})
	}
}

// TestAMissingMarkIsReportedAndFallsBack.
//
// The fallback is deliberate and it is the only place in this file that prefers
// carrying on to failing: an icon's absence is a broken-image placeholder on the
// one screen somebody reads before deciding whether to press update, so the wrong
// mark beats no mark. What must not happen is it being quiet.
func TestAMissingMarkIsReportedAndFallsBack(t *testing.T) {
	web := webWithIcons()
	delete(web, "urd-icon-512.png")

	var reported []string
	got := resolveNotesAssets(web, func(name, alias string) {
		reported = append(reported, name+" → "+alias)
	})

	if len(reported) != 1 || reported[0] != "icon-512.png → urd-icon-512.png" {
		t.Errorf("the missing icon was reported as %v, want exactly one naming both paths", reported)
	}
	if _, ok := got["icon-512.png"]; ok {
		t.Error("a path with no file behind it was aliased anyway")
	}
	if got["icon.svg"] != "urd-icon.svg" {
		t.Error("one missing icon took the other three with it")
	}
}

// TestTheUrdDoorIsItsOwnApp.
//
// An operating system does not install a URL, it installs a manifest, and the
// identity of an installed app is that manifest's `id`. So this asserts the two
// things that decide whether /urd becomes a second icon on a home screen or just a
// bookmark into the first one — and it asserts them as named values, because an
// empty manifest, verdande's manifest and urd's all parse as JSON.
func TestTheUrdDoorIsItsOwnApp(t *testing.T) {
	srv := serverWithWeb(t, "full", webWithIcons())

	if srv.door("urd") == nil || srv.door("urd.webmanifest") == nil {
		t.Fatal("the full edition does not serve the urd door; it is a second face, not an edition")
	}

	shell := string(srv.door("urd"))
	for _, want := range []string{
		"<title>urd</title>",
		`<link rel="manifest" href="/urd.webmanifest" />`,
		// iOS reads this one by name and has historically ignored the manifest's
		// icons entirely, which is why the shell is served per door rather than
		// patched by script after load.
		`<link rel="apple-touch-icon" href="/urd-apple-touch-icon.png" />`,
		`<link rel="icon" href="/urd-icon.svg" type="image/svg+xml" />`,
	} {
		if !strings.Contains(shell, want) {
			t.Errorf("the urd door's shell does not contain %q", want)
		}
	}
	// The same trap as the edition shell: the two doors share an origin and
	// therefore share localStorage, so renaming a storage key here would give the
	// two apps different themes by accident.
	if !strings.Contains(shell, `localStorage.getItem('verdande:theme')`) {
		t.Error("the urd door's shell lost a storage key; the two doors share one origin and one localStorage")
	}

	var m map[string]any
	if err := json.Unmarshal(srv.door("urd.webmanifest"), &m); err != nil {
		t.Fatalf("the urd manifest is not JSON: %v", err)
	}
	for key, want := range map[string]any{
		// id is the install identity. Without it, two manifests on one origin are
		// one app with two start urls.
		"id":         "/urd",
		"start_url":  "/urd",
		"scope":      "/",
		"name":       "urd",
		"short_name": "urd",
	} {
		if m[key] != want {
			t.Errorf("the urd manifest has %s = %v, want %v", key, m[key], want)
		}
	}
	// And the shared half, to prove it was transformed rather than written out: a
	// hand-written copy would drift on exactly these.
	var built map[string]any
	raw, _ := fs.ReadFile(webWithIcons(), "manifest.webmanifest")
	_ = json.Unmarshal(raw, &built)
	for _, key := range []string{"display", "background_color", "theme_color", "lang"} {
		if _, ok := built[key]; ok && m[key] != built[key] {
			t.Errorf("the urd manifest lost the built one's %s: %v vs %v", key, m[key], built[key])
		}
	}

	icons, _ := m["icons"].([]any)
	if len(icons) == 0 {
		t.Fatal("the urd manifest has no icons")
	}
	for i, entry := range icons {
		src, _ := entry.(map[string]any)["src"].(string)
		if !strings.HasPrefix(src, "/urd-") {
			t.Errorf("icon %d is %q — the urd manifest points at verdande's mark", i, src)
		}
	}
	t.Logf("urd door: shell %d bytes, manifest %d bytes, %d icons", len(srv.door("urd")), len(srv.door("urd.webmanifest")), len(icons))
}

// TestAnUnknownIconStopsTheUrdManifest is the direction that matters: an icon
// added to the built manifest and not to urd's map would otherwise leave urd's
// install prompt showing Verdande's mark, which nobody reports.
func TestAnUnknownIconStopsTheUrdManifest(t *testing.T) {
	raw := []byte(`{"name":"verdande","icons":[{"src":"/icon-1024.png","sizes":"1024x1024"}]}`)
	if _, err := urdManifest(raw); err == nil {
		t.Error("urdManifest accepted an icon it has no file for")
	} else if !strings.Contains(err.Error(), "/icon-1024.png") {
		t.Errorf("the error does not name the icon: %v", err)
	}
}

// TestTheWebmanifestTypeCoversBothDoors. A manifest served as text/html is ignored
// by the browser with no error anywhere; the only symptom is that the install
// prompt does not appear. This read `name == "manifest.webmanifest"` when the
// second door was added.
func TestTheWebmanifestTypeCoversBothDoors(t *testing.T) {
	for _, name := range []string{"manifest.webmanifest", "urd.webmanifest"} {
		if got := contentTypeFor(name); got != "application/manifest+json" {
			t.Errorf("%s is served as %q", name, got)
		}
	}
	if got := contentTypeFor("index.html"); got != "text/html; charset=utf-8" {
		t.Errorf("index.html is served as %q", got)
	}
}