package api

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"chfs-ng/internal/auth"
	"chfs-ng/internal/storage"
)

func TestRootAndAPIDoc(t *testing.T) {
	s := &Server{Store: storage.Local{Root: t.TempDir()}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, HTMLTitle: "My Files", HTMLNotice: "`<strong>Hello</strong>`"}
	h := s.Handler()
	r := httptest.NewRecorder()
	h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/", nil))
	if r.Code != 200 || !strings.Contains(r.Body.String(), "<title>My Files</title>") || !strings.Contains(r.Body.String(), "<strong>Hello</strong>") {
		t.Fatalf("root: %d %s", r.Code, r.Body.String())
	}
	r = httptest.NewRecorder()
	h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/asset/api.html", nil))
	if r.Code != 200 || !strings.Contains(r.Body.String(), "/chfs/files") {
		t.Fatalf("api doc: %d %s", r.Code, r.Body.String())
	}
}

func TestRootEscapesPlainNotice(t *testing.T) {
	s := &Server{Store: storage.Local{Root: t.TempDir()}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, HTMLNotice: `<script>alert(1)</script>`}
	r := httptest.NewRecorder()
	s.Handler().ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/", nil))
	if strings.Contains(r.Body.String(), `<script>alert(1)</script>`) {
		t.Fatal("plain notice was not escaped")
	}
}