| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "image/png" |
| 6 | "os" |
| 7 | "path/filepath" |
| 8 | "regexp" |
| 9 | "strings" |
| 10 | "testing" |
| 11 | ) |
| 12 | |
| 13 | // Mutation-checked 2026-09-12 with cases chosen by an independent reviewer: |
| 14 | // wrong icon.svg MIME type and removal of the directory mount both fail. |
| 15 | func TestDirectoryBrandAssetsArePublicAndListingKeepsNames(t *testing.T) { |
| 16 | f := newMountedChooser(t) |
| 17 | page := f.request("GET", "/", "", "", f.session(t, chooserPerson)) |
| 18 | if page.Code != 200 { |
| 19 | t.Fatal(page.Code) |
| 20 | } |
| 21 | body := page.Body.String() |
| 22 | for _, name := range []string{"Docs", "Sheets", "Slides", "Calendar", "Calls", "Memoria"} { |
| 23 | path := "/static/brand/" + strings.ToLower(name) + ".svg" |
| 24 | if !strings.Contains(body, `src="`+versioned(path)+`" alt=""`) || !strings.Contains(body, ">"+name+"<") { |
| 25 | t.Fatal("listing lost icon or name", name) |
| 26 | } |
| 27 | // No session on the asset request: every sign-in surface needs its |
| 28 | // branding before the reader has authenticated. |
| 29 | asset := f.request("GET", path, "", "", nil) |
| 30 | if asset.Code != 200 || asset.Header().Get("Content-Type") != "image/svg+xml" || !strings.Contains(asset.Body.String(), "<title>"+name+"</title>") || len(asset.Result().Cookies()) != 0 { |
| 31 | t.Fatal("wrong or inaccessible product artwork", name, asset.Code) |
| 32 | } |
| 33 | } |
| 34 | // Every asset linked by the rendered directory must work anonymously, |
| 35 | // including Oficina's own favicon and the PNG home-screen exports. |
| 36 | for _, match := range regexp.MustCompile(`(?:href|src)="(/static/[^" ]+)"`).FindAllStringSubmatch(body, -1) { |
| 37 | asset := f.request("GET", match[1], "", "", nil) |
| 38 | if asset.Code != 200 || asset.Body.Len() == 0 || len(asset.Result().Cookies()) != 0 { |
| 39 | t.Fatal("public page asset unavailable", match[1]) |
| 40 | } |
| 41 | switch filepath.Ext(match[1]) { |
| 42 | case ".svg": |
| 43 | if asset.Header().Get("Content-Type") != "image/svg+xml" || !bytes.Contains(asset.Body.Bytes(), []byte("<svg")) { |
| 44 | t.Fatal("SVG cannot render", match[1]) |
| 45 | } |
| 46 | case ".png": |
| 47 | if _, err := png.DecodeConfig(bytes.NewReader(asset.Body.Bytes())); err != nil || asset.Header().Get("Content-Type") != "image/png" { |
| 48 | t.Fatal("PNG cannot render", match[1], err) |
| 49 | } |
| 50 | case ".css": |
| 51 | if !strings.HasPrefix(asset.Header().Get("Content-Type"), "text/css") { |
| 52 | t.Fatal("stylesheet cannot load", match[1]) |
| 53 | } |
| 54 | } |
| 55 | } |
| 56 | if output := os.Getenv("HOME_BRAND_EVIDENCE_DIR"); output != "" { |
| 57 | if err := os.MkdirAll(output, 0700); err != nil { |
| 58 | t.Fatal(err) |
| 59 | } |
| 60 | if err := os.WriteFile(filepath.Join(output, "page.html"), page.Body.Bytes(), 0600); err != nil { |
| 61 | t.Fatal(err) |
| 62 | } |
| 63 | for _, match := range regexp.MustCompile(`(?:href|src)="(/static/[^" ]+)"`).FindAllStringSubmatch(body, -1) { |
| 64 | asset := f.request("GET", match[1], "", "", nil) |
| 65 | if asset.Code != 200 { |
| 66 | t.Fatal("page asset unavailable", match[1]) |
| 67 | } |
| 68 | if err := os.WriteFile(filepath.Join(output, filepath.Base(match[1])), asset.Body.Bytes(), 0600); err != nil { |
| 69 | t.Fatal(err) |
| 70 | } |
| 71 | } |
| 72 | } |
| 73 | } |
| 74 | |
amadan