path: root/internal/web/server_test.go

package web

import (
	"net"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/lukaszkasprzak/lectio/internal/config"
	"github.com/lukaszkasprzak/lectio/internal/liturgy"
)

// TestServer exercises NewServer's handler tree end to end via httptest,
// against the same fixture HTML/hook internal/readings uses (see
// readings_test.go TestLoadModernRoutes): no real network, no real browser.
func TestServer(t *testing.T) {
	html, err := os.ReadFile("../liturgy/testdata/2026-07-22.html")
	if err != nil {
		t.Fatal(err)
	}
	fixtureServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Write(html)
	}))
	defer fixtureServer.Close()
	liturgy.SetBaseURL(fixtureServer.URL + "/liturgia/%s/Ewangelia")
	cacheHome := t.TempDir()
	t.Setenv("XDG_CACHE_HOME", cacheHome)

	srv := NewServer(config.Default())

	t.Run("index page", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/?date=2026-07-22&v=wuj", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		body := rec.Body.String()
		// config.Default() -> UILanguage "en", so the gospel heading's part
		// label is localised to "Gospel" (render.LocalizeHeading); the
		// citation stays exactly as scraped.
		if !strings.Contains(body, "Gospel") {
			t.Errorf("body missing reading heading: %q", body)
		}
		if !strings.Contains(body, "htmx") {
			t.Errorf("body missing htmx reference")
		}
		if !strings.Contains(body, `id="theme"`) {
			t.Errorf("body missing theme <link>")
		}
		// Name is source-language (Polish), never translated, even
		// though the surrounding chrome is English -- see RenderReadings.
		if !strings.Contains(body, `class="dayinfo"`) || !strings.Contains(body, "Święto św. Marii Magdaleny") {
			t.Errorf("body missing day-info header: %q", body)
		}
	})

	t.Run("readings partial", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=2026-07-22&v=wuj&all=1", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		body := rec.Body.String()
		if strings.Contains(body, "<html") {
			t.Errorf("partial is not a fragment: %q", body)
		}
		// See "index page" above: config.Default() is English chrome.
		if !strings.Contains(body, "Gospel") {
			t.Errorf("partial missing reading heading: %q", body)
		}
	})

	t.Run("theme.css", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/theme.css?name=benedictines", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		if !strings.Contains(rec.Header().Get("Content-Type"), "css") {
			t.Errorf("Content-Type = %q, want it to contain css", rec.Header().Get("Content-Type"))
		}
	})

	t.Run("static", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/static/htmx.min.js", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		if rec.Body.Len() == 0 {
			t.Error("static/htmx.min.js served empty body")
		}
	})

	t.Run("theme.css unknown falls back", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/theme.css?name=does-not-exist", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200 (fallback to cfg.WebTheme/default)", rec.Code)
		}
		if rec.Body.Len() == 0 {
			t.Error("theme.css fallback served empty body")
		}
	})

	t.Run("readings partial interlinear", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=2026-07-22&v=wuj&v=vul&display=interlinear", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		body := rec.Body.String()
		if strings.Contains(body, "<html") {
			t.Errorf("partial is not a fragment: %q", body)
		}
		i := strings.Index(body, `class="vnum"`)
		if i == -1 {
			t.Fatalf("interlinear partial missing a vnum verse label: %q", body)
		}
		// Bound the first ilverse block by the next vnum span (each ilverse
		// carries exactly one), so the check covers every version's line
		// grouped under that one key, not just the first.
		block := body[i:]
		if j := strings.Index(body[i+1:], `class="vnum"`); j != -1 {
			block = body[i : i+1+j]
		}
		// config.Default() is English chrome: "Wujek (Polish)"/"Vulgate (Latin)".
		if !strings.Contains(block, "Wujek") || !strings.Contains(block, "Vulgate") {
			t.Errorf("interlinear verse block missing both version labels grouped together: %q", block)
		}
	})

	t.Run("readings partial vertical", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=2026-07-22&v=wuj&v=vul&display=vertical", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		if !strings.Contains(rec.Body.String(), "display-vertical") {
			t.Errorf("vertical partial missing display-vertical: %q", rec.Body.String())
		}
	})

	t.Run("readings partial interlinear substitutes bt", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=2026-07-22&v=bt&display=interlinear", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		body := rec.Body.String()
		if !strings.Contains(body, "Wujek") {
			t.Errorf("bt should be substituted with wuj in interlinear mode: %q", body)
		}
		if strings.Contains(body, "Biblia Tysiąclecia (niedziela.pl)") {
			t.Errorf("bt paragraph column should not appear in interlinear mode: %q", body)
		}
	})

	t.Run("readings partial bad display falls back to horizontal", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=2026-07-22&v=wuj&display=bogus", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		body := rec.Body.String()
		if strings.Contains(body, "display-vertical") || strings.Contains(body, "ilverse") {
			t.Errorf("bad display should fall back to horizontal, got: %q", body)
		}
	})

	t.Run("index page seeds display select from cfg", func(t *testing.T) {
		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/?date=2026-07-22&v=wuj", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		if !strings.Contains(rec.Body.String(), `name="display"`) {
			t.Errorf("body missing display select: %q", rec.Body.String())
		}
	})

	// Regression coverage for the ?date= path-traversal finding: resolveQuery
	// must reject anything that isn't YYYY-MM-DD and fall back to today(),
	// the same "normalize, don't trust" pattern requestDisplay already uses.
	t.Run("date path traversal does not read a planted cache file", func(t *testing.T) {
		// cacheDir() == filepath.Join(cacheHome, "lectio"), so
		// filepath.Join(cacheDir(), "../evil"+".json") resolves to
		// cacheHome/evil.json -- one level *above* the real cache dir, and
		// only reachable via an unvalidated "../" date. If the marker below
		// ever appears in a response, liturgy.Load read this planted file.
		evilPath := filepath.Join(cacheHome, "evil.json")
		evilJSON := `[{"Heading":"LEAKED-VIA-TRAVERSAL","PartID":"ewangelia","Paragraphs":[["s"]]}]`
		if err := os.WriteFile(evilPath, []byte(evilJSON), 0o644); err != nil {
			t.Fatal(err)
		}

		baseline := httptest.NewRecorder()
		srv.ServeHTTP(baseline, httptest.NewRequest("GET", "/readings?v=wuj", nil)) // no date -> today()
		if baseline.Code != http.StatusOK {
			t.Fatalf("baseline status = %d, want 200", baseline.Code)
		}

		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=../evil&v=wuj", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		body := rec.Body.String()
		if strings.Contains(body, "LEAKED-VIA-TRAVERSAL") {
			t.Fatalf("traversal date reached the planted cache file outside the cache dir: %q", body)
		}
		if body != baseline.Body.String() {
			t.Errorf("traversal date did not fall back to today() identically to omitting date\n got:  %q\nwant:  %q", body, baseline.Body.String())
		}
	})

	t.Run("date query with many ../ segments falls back to today, same as omitting date", func(t *testing.T) {
		baseline := httptest.NewRecorder()
		srv.ServeHTTP(baseline, httptest.NewRequest("GET", "/readings?v=wuj", nil)) // no date -> today()

		rec := httptest.NewRecorder()
		srv.ServeHTTP(rec, httptest.NewRequest("GET", "/readings?date=../../../../etc/hostname&v=wuj", nil))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, want 200", rec.Code)
		}
		if rec.Body.String() != baseline.Body.String() {
			t.Errorf("traversal-shaped date did not behave identically to omitting date\n got:  %q\nwant:  %q", rec.Body.String(), baseline.Body.String())
		}
	})
}

// TestBTHiddenForTraditional checks index.html's server-side initial-hidden
// state for the "bt" version checkbox: hidden (inline style) when the
// lectionary is traditional (bt is meaningless for missalemeum -- see
// render.EffectiveVersions), present and visible otherwise. This is
// presentation-only: it does not touch which versions actually load.
func TestBTHiddenForTraditional(t *testing.T) {
	srv := NewServer(config.Default())
	trad := httptest.NewRecorder()
	srv.ServeHTTP(trad, httptest.NewRequest("GET", "/?lectionary=traditional", nil))
	if !strings.Contains(trad.Body.String(), `id="ver-bt" style="display:none"`) {
		t.Errorf("bt checkbox not hidden for traditional")
	}
	modern := httptest.NewRecorder()
	srv.ServeHTTP(modern, httptest.NewRequest("GET", "/?lectionary=new", nil))
	b := modern.Body.String()
	if !strings.Contains(b, `id="ver-bt">`) || strings.Contains(b, `id="ver-bt" style="display:none"`) {
		t.Errorf("bt checkbox should be visible for modern")
	}
}

func TestReaderDefault(t *testing.T) {
	srv := NewServer(config.Default())
	rec := httptest.NewRecorder()
	srv.ServeHTTP(rec, httptest.NewRequest("GET", "/reader", nil))
	if rec.Code != 200 {
		t.Fatalf("status %d", rec.Code)
	}
	body := rec.Body.String()
	if !strings.Contains(body, `id="reader-root"`) || !strings.Contains(body, `id="pane"`) {
		t.Errorf("reader page missing root/pane")
	}
	if !strings.Contains(body, "Genesis") { // book <option> label (en dialect)
		t.Errorf("book options missing Genesis")
	}
}

func TestReaderPassage(t *testing.T) {
	srv := NewServer(config.Default())
	rec := httptest.NewRecorder()
	srv.ServeHTTP(rec, httptest.NewRequest("GET", "/reader?book=John&chap=3&v=wuj", nil))
	if rec.Code != 200 {
		t.Fatalf("status %d", rec.Code)
	}
	if b := rec.Body.String(); !strings.Contains(b, "John 3") || !strings.Contains(b, "3:16") {
		t.Errorf("passage missing heading/verse")
	}
}

func TestReaderCompareAndBTFilter(t *testing.T) {
	srv := NewServer(config.Default())
	rec := httptest.NewRecorder()
	// bt must be dropped (no corpus); wuj+vul compared side by side.
	srv.ServeHTTP(rec, httptest.NewRequest("GET", "/reader?book=John&chap=3&v=bt&v=wuj&v=vul&display=vertical", nil))
	if rec.Code != 200 {
		t.Fatalf("status %d", rec.Code)
	}
	b := rec.Body.String()
	if !strings.Contains(b, "display-vertical") {
		t.Errorf("vertical compare layout missing")
	}
}

func TestReaderInvalidBook(t *testing.T) {
	srv := NewServer(config.Default())
	rec := httptest.NewRecorder()
	srv.ServeHTTP(rec, httptest.NewRequest("GET", "/reader?book=Nonsense", nil))
	if rec.Code != 200 { // defaults to the first book, never 500
		t.Errorf("invalid book status %d want 200", rec.Code)
	}
}

// TestRenderOrErrorNoSectionsLang checks the "no readings at all for this
// day" fragment (finding §1) follows lang instead of always being Polish.
func TestRenderOrErrorNoSectionsLang(t *testing.T) {
	html := string(renderOrError(nil, nil, "new", "horizontal", "en", liturgy.DayInfo{}, nil))
	if !strings.Contains(html, "no readings for this day") {
		t.Errorf("en renderOrError(no secs) = %q, want it to contain %q", html, "no readings for this day")
	}
	if strings.Contains(html, "czyta") {
		t.Errorf("en renderOrError(no secs) should not carry Polish wording: %q", html)
	}

	html = string(renderOrError(nil, nil, "new", "horizontal", "pl", liturgy.DayInfo{}, nil))
	if !strings.Contains(html, "brak czytań na ten dzień") {
		t.Errorf("pl renderOrError(no secs) = %q, want it to contain %q", html, "brak czytań na ten dzień")
	}
}

// TestIndexHTMLLangAttribute checks index.html's <html lang="..."> follows
// cfg.UILanguage (finding §6) instead of being hardcoded "pl".
func TestIndexHTMLLangAttribute(t *testing.T) {
	html, err := os.ReadFile("../liturgy/testdata/2026-07-22.html")
	if err != nil {
		t.Fatal(err)
	}
	fixtureServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Write(html)
	}))
	defer fixtureServer.Close()
	liturgy.SetBaseURL(fixtureServer.URL + "/liturgia/%s/Ewangelia")
	t.Setenv("XDG_CACHE_HOME", t.TempDir())

	cfg := config.Default()
	cfg.UILanguage = "en"
	rec := httptest.NewRecorder()
	NewServer(cfg).ServeHTTP(rec, httptest.NewRequest("GET", "/?date=2026-07-22&v=wuj", nil))
	if !strings.Contains(rec.Body.String(), `<html lang="en">`) {
		t.Errorf(`en index page missing <html lang="en">: %q`, rec.Body.String()[:min(400, rec.Body.Len())])
	}

	cfg.UILanguage = "pl"
	rec = httptest.NewRecorder()
	NewServer(cfg).ServeHTTP(rec, httptest.NewRequest("GET", "/?date=2026-07-22&v=wuj", nil))
	if !strings.Contains(rec.Body.String(), `<html lang="pl">`) {
		t.Errorf(`pl index page missing <html lang="pl">: %q`, rec.Body.String()[:min(400, rec.Body.Len())])
	}
}

// TestChooseListener exercises chooseListener's port-selection logic
// directly (no HTTP serving): port==0 prefers defaultWebPort (1099) and
// falls back to a free OS port when 1099 is taken, and a non-zero port is
// bound exactly. Sandboxed/CI environments may not permit binding 1099 (or
// may race another process for it), so those assertions t.Skip rather than
// fail the suite.
func TestChooseListener(t *testing.T) {
	t.Run("zero port returns a listener with a non-zero port", func(t *testing.T) {
		ln, err := chooseListener(0)
		if err != nil {
			t.Fatalf("chooseListener(0) error: %v", err)
		}
		defer ln.Close()
		port := ln.Addr().(*net.TCPAddr).Port
		if port == 0 {
			t.Errorf("chooseListener(0) returned port 0, want non-zero")
		}
	})

	t.Run("falls back to a free port when 1099 is taken", func(t *testing.T) {
		pre, err := net.Listen("tcp", ":1099")
		if err != nil {
			t.Skipf("cannot bind :1099 in this environment, skipping fallback assertion: %v", err)
		}
		defer pre.Close()

		ln, err := chooseListener(0)
		if err != nil {
			t.Fatalf("chooseListener(0) error while 1099 is taken: %v", err)
		}
		defer ln.Close()
		port := ln.Addr().(*net.TCPAddr).Port
		if port == 1099 {
			t.Errorf("chooseListener(0) returned 1099 even though it was already taken")
		}
	})

	t.Run("explicit non-zero port is bound exactly", func(t *testing.T) {
		probe, err := net.Listen("tcp", ":0")
		if err != nil {
			t.Skipf("cannot bind :0 to pick a free port in this environment: %v", err)
		}
		want := probe.Addr().(*net.TCPAddr).Port
		probe.Close()

		ln, err := chooseListener(want)
		if err != nil {
			t.Skipf("could not bind explicit port %d (likely a race with another process): %v", want, err)
		}
		defer ln.Close()
		got := ln.Addr().(*net.TCPAddr).Port
		if got != want {
			t.Errorf("chooseListener(%d) bound port %d, want exactly %d", want, got, want)
		}
	})
}