package middleware_test

import (
	"io/fs"
	"os"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

// Go-source CSP tripwire.
//
// The templ scan lives in templates/csp_source_test.go, but htmx partials
// can also be emitted from Go handler strings — auth.go used to answer a
// successful login with an inline <script>window.location…</script> that
// hash-mode CSP silently refused. This test scans the non-test Go sources
// for the same forbidden patterns: inline script tags and native on*=
// handler attributes in emitted HTML. Partials that need to navigate or
// stash state use data attributes + web/src/auth_forms.ts, or htmx's
// HX-Redirect/HX-Refresh headers.

var goScriptTagRe = regexp.MustCompile(`<script`)

var goHandlerAttrRe = regexp.MustCompile(
	`on(click|error|submit|load|change|input|focus|blur|mouseover|keydown|keyup)\s*=\s*"`)

func TestGoSourcesAreCSPSafe(t *testing.T) {
	root := "../.."
	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if d.IsDir() {
			switch d.Name() {
			case "node_modules", "static", ".git", "testdata", "docs":
				return filepath.SkipDir
			}
			return nil
		}
		name := d.Name()
		if !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
			return nil
		}
		// Generated templ codegen is out of scope: its source of truth is
		// the .templ file (scanned by templates/csp_source_test.go), and
		// the codegen legitimately emits external <script src=…> tags.
		if strings.HasSuffix(name, "_templ.go") {
			return nil
		}
		raw, err := os.ReadFile(path)
		if err != nil {
			return err
		}
		src := string(raw)
		for _, m := range goScriptTagRe.FindAllStringIndex(src, -1) {
			t.Errorf("%s:%d: literal <script> in Go source — hash-mode CSP refuses inline scripts in emitted partials; use data attributes + web/src/auth_forms.ts or HX-Redirect/HX-Refresh",
				path, 1+strings.Count(src[:m[0]], "\n"))
		}
		for _, m := range goHandlerAttrRe.FindAllStringIndex(src, -1) {
			t.Errorf("%s:%d: native on*= handler attribute in Go source — CSP hash-mode refuses it; use Alpine bindings or delegated listeners",
				path, 1+strings.Count(src[:m[0]], "\n"))
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
}