c90f9c0ef6
Addresses review 1863 (delta) on PR #119. MUST-FIX: - detailsToHtml (the raw-HTML path used for a details nested inside columns/spanned cells) now emits `<details${open}>`, mirroring the top-level case, so `open` no longer silently drops every round trip. - Remove the dead `resolveApplyClient` delete-cap hook from the engine `runCycle`: the orchestrator stopped passing it, so the hook + its dry-run pass were inert. Deletes are soft (Trash) + always logged and engine convergence is the guard, so no cap is re-added — just the dead wiring removed. TEST COVERAGE: - space-lock: heartbeat refresh CAS-miss (eval -> 0) and Redis-error (eval throws) both abort the in-flight fn's signal. - cycle: a pre-aborted signal (and an abort during the pull read) throws before the push apply / first destructive phase. - converter: htmlEmbed source VALUE + height survive; encode/decode UTF-8 symmetry and '' -> ''; footnote definition body + ref/def id match; transclusionReference both ids survive; fix the bad transclusionSource fixture (wrong `pageId` attr + empty content -> schema `id` + a block child); nested details `open` parity test. - orchestrator: autoMergeConflicts:true reaches engine settings; default false on a missing settings row. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
101 lines
3.5 KiB
TypeScript
101 lines
3.5 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import {
|
|
sanitizeCssColor,
|
|
clampCalloutType,
|
|
encodeHtmlEmbedSource,
|
|
decodeHtmlEmbedSource,
|
|
} from '../src/lib/docmost-schema.js';
|
|
|
|
// These tests pin the two security/normalization helpers that Docmost
|
|
// interpolates into inline style and the callout banner type on re-render.
|
|
// They are the allowlist guard (XSS/style-breakout boundary) and the
|
|
// case-insensitive callout normalizer, both otherwise only exercised
|
|
// indirectly through parseHTML/renderHTML.
|
|
|
|
describe('sanitizeCssColor', () => {
|
|
it('accepts a plain named color unchanged', () => {
|
|
expect(sanitizeCssColor('red')).toBe('red');
|
|
});
|
|
|
|
it('accepts 3-digit and 6-digit hex colors unchanged', () => {
|
|
expect(sanitizeCssColor('#abc')).toBe('#abc');
|
|
expect(sanitizeCssColor('#aabbcc')).toBe('#aabbcc');
|
|
});
|
|
|
|
it('accepts well-formed functional notation unchanged', () => {
|
|
expect(sanitizeCssColor('rgb(1,2,3)')).toBe('rgb(1,2,3)');
|
|
expect(sanitizeCssColor('rgba(0,0,0,0.5)')).toBe('rgba(0,0,0,0.5)');
|
|
expect(sanitizeCssColor('hsl(120,50%,50%)')).toBe('hsl(120,50%,50%)');
|
|
});
|
|
|
|
it('trims surrounding whitespace before matching', () => {
|
|
// ' blue ' trims to 'blue', which is a valid named color.
|
|
expect(sanitizeCssColor(' blue ')).toBe('blue');
|
|
});
|
|
|
|
it('rejects a style-injection payload (returns null)', () => {
|
|
expect(sanitizeCssColor('red; --x: url(x)')).toBeNull();
|
|
});
|
|
|
|
it('rejects an attribute-breakout payload (returns null)', () => {
|
|
expect(sanitizeCssColor('red"><script>')).toBeNull();
|
|
});
|
|
|
|
it('rejects the empty string (returns null)', () => {
|
|
expect(sanitizeCssColor('')).toBeNull();
|
|
});
|
|
|
|
it('rejects non-string input via the typeof guard (returns null)', () => {
|
|
// @ts-expect-error deliberately passing a non-string to exercise the guard
|
|
expect(sanitizeCssColor(123)).toBeNull();
|
|
});
|
|
});
|
|
|
|
describe('clampCalloutType', () => {
|
|
it('lowercases an uppercase valid type', () => {
|
|
expect(clampCalloutType('INFO')).toBe('info');
|
|
});
|
|
|
|
it('lowercases a mixed-case valid type', () => {
|
|
expect(clampCalloutType('Warning')).toBe('warning');
|
|
});
|
|
|
|
it('passes through already-lowercase valid types', () => {
|
|
expect(clampCalloutType('danger')).toBe('danger');
|
|
expect(clampCalloutType('success')).toBe('success');
|
|
});
|
|
|
|
it('falls back to "info" for unknown types', () => {
|
|
expect(clampCalloutType('note')).toBe('info');
|
|
expect(clampCalloutType('tip')).toBe('info');
|
|
});
|
|
|
|
it('falls back to "info" for empty string and null', () => {
|
|
expect(clampCalloutType('')).toBe('info');
|
|
expect(clampCalloutType(null)).toBe('info');
|
|
});
|
|
});
|
|
|
|
// The htmlEmbed `source` rides the data-source attribute base64-encoded so the
|
|
// raw HTML/CSS/JS stays inert and double-encoding-free across a round trip.
|
|
// Encode/decode MUST be exact inverses (incl. UTF-8) or the embed body corrupts.
|
|
describe('encode/decodeHtmlEmbedSource', () => {
|
|
it('round-trips ASCII HTML losslessly', () => {
|
|
const src = '<b>hi</b>';
|
|
expect(decodeHtmlEmbedSource(encodeHtmlEmbedSource(src))).toBe(src);
|
|
});
|
|
|
|
it('round-trips multi-byte UTF-8 (Cyrillic + emoji) losslessly', () => {
|
|
const src = '<p>Привет, мир 🌍 — café</p>';
|
|
const encoded = encodeHtmlEmbedSource(src);
|
|
// It is actually encoded (not passed through verbatim).
|
|
expect(encoded).not.toBe(src);
|
|
expect(decodeHtmlEmbedSource(encoded)).toBe(src);
|
|
});
|
|
|
|
it('maps empty string to empty string both ways', () => {
|
|
expect(encodeHtmlEmbedSource('')).toBe('');
|
|
expect(decodeHtmlEmbedSource('')).toBe('');
|
|
});
|
|
});
|