summercms/postcard/mailer_test.go

package postcard

import (
	"context"
	"strings"
	"testing"
	"testing/fstest"
)

func TestMailRenderSmoke(t *testing.T) {
	t.Parallel()

	fsys := fstest.MapFS{
		"views/mail/hello.htm": {Data: []byte(`subject = "Witaj {{ .Name }}"
description = "Hello greeting"
layout = "default"
==
Witaj **{{ .Name }}**.

[Strona]({{ .URL }})
`)},
		"views/mail/hello-en.htm": {Data: []byte(`subject = "Hello {{ .Name }}"
description = "English hello greeting"
layout = "default"
==
Hello **{{ .Name }}**.

[Site]({{ .URL }})
`)},
	}
	cat := NewCatalog()
	err := cat.Register("golem15.hello", fsys, []string{
		"golem15.hello::mail.hello",
		"golem15.hello::mail.hello-en",
	}, nil)
	if err != nil {
		t.Fatalf("Register: %v", err)
	}
	drv := NewMemoryDriver()
	mail := NewMailer(cat, drv, Options{})
	ctx := context.Background()
	vars := map[string]any{"Name": "Ada", "URL": "https://example.test"}

	if err := mail.Send(ctx, Message{
		Template: "golem15.hello::mail.hello",
		To:       []string{"ada@example.test"},
		Vars:     vars,
	}); err != nil {
		t.Fatalf("Send hello: %v", err)
	}
	if err := mail.Send(ctx, Message{
		Template: "golem15.hello::mail.hello-en",
		To:       []string{"ada@example.test"},
		Vars:     vars,
	}); err != nil {
		t.Fatalf("Send hello-en: %v", err)
	}

	got := drv.Messages()
	if len(got) != 2 {
		t.Fatalf("stored %d messages, want 2", len(got))
	}
	pl, en := got[0], got[1]
	if pl.Subject != "Witaj Ada" {
		t.Fatalf("default locale subject = %q", pl.Subject)
	}
	if en.Subject != "Hello Ada" {
		t.Fatalf("-en subject = %q", en.Subject)
	}
	if !strings.Contains(pl.Text, "Witaj **Ada**.") || strings.Contains(pl.Text, "Hello **Ada**.") {
		t.Fatalf("default locale text = %q", pl.Text)
	}
	if !strings.Contains(en.Text, "Hello **Ada**.") || strings.Contains(en.Text, "Witaj **Ada**.") {
		t.Fatalf("-en text = %q", en.Text)
	}
	if !strings.Contains(pl.HTML, "<strong>Ada</strong>") || !strings.Contains(pl.HTML, `href="https://example.test"`) {
		t.Fatalf("default locale HTML = %q", pl.HTML)
	}
	if !strings.Contains(en.HTML, "<strong>Ada</strong>") || !strings.Contains(en.HTML, `href="https://example.test"`) {
		t.Fatalf("-en HTML = %q", en.HTML)
	}
	if !strings.Contains(pl.HTML, `class="content-body"`) || !strings.Contains(en.HTML, `class="content-body"`) {
		t.Fatalf("neutral default layout missing from HTML")
	}

	t.Run("unsafe vars stay out of HTML", func(t *testing.T) {
		drv := NewMemoryDriver()
		mail := NewMailer(cat, drv, Options{})
		if err := mail.Send(ctx, Message{
			Template: "golem15.hello::mail.hello-en",
			To:       []string{"ada@example.test"},
			Vars: map[string]any{
				"Name": `<script>alert(1)</script>`,
				"URL":  "javascript:alert(1)",
			},
		}); err != nil {
			t.Fatalf("Send: %v", err)
		}
		html := drv.Messages()[0].HTML
		if strings.Contains(strings.ToLower(html), "<script") || strings.Contains(strings.ToLower(html), "javascript:") {
			t.Fatalf("unsafe HTML leaked: %s", html)
		}
	})
}

func TestMailLayoutSmoke(t *testing.T) {
	t.Parallel()

	fsys := fstest.MapFS{
		"views/mail/note.htm": {Data: []byte(`subject = "Hi {{ .Name }}"
layout = "hello"
==
Body **{{ .Name }}**.
`)},
		"views/mail/layouts/hello.htm": {Data: []byte(`name = "Hello"
==
-- {{ .Content }} --
==
<div class="layout-hello">{{ .Content }}</div>
<style>{{ .brandCss }}{{ .css }}</style>
`)},
	}
	cat := NewCatalog()
	if err := cat.Register("golem15.hello", fsys, []string{"golem15.hello::mail.note"}, map[string]string{
		"hello": "golem15.hello::mail.layouts.hello",
	}); err != nil {
		t.Fatalf("Register: %v", err)
	}
	drv := NewMemoryDriver()
	mail := NewMailer(cat, drv, Options{CSS: "p{color:red}", BrandCSS: ".brand{color:blue}"})
	if err := mail.Send(context.Background(), Message{
		Template: "golem15.hello::mail.note",
		To:       []string{"ada@example.test"},
		Vars:     map[string]any{"Name": "Ada"},
	}); err != nil {
		t.Fatalf("Send: %v", err)
	}
	got := drv.Messages()
	if len(got) != 1 {
		t.Fatalf("stored %d messages", len(got))
	}
	if !strings.Contains(got[0].Text, "-- Body **Ada**. --") {
		t.Fatalf("text wrapper = %q", got[0].Text)
	}
	if !strings.Contains(got[0].HTML, `class="layout-hello"`) || !strings.Contains(got[0].HTML, "<strong>Ada</strong>") {
		t.Fatalf("HTML wrapper = %q", got[0].HTML)
	}
	if !strings.Contains(got[0].HTML, "p{color:red}") || !strings.Contains(got[0].HTML, ".brand{color:blue}") {
		t.Fatalf("shared css missing: %q", got[0].HTML)
	}

	t.Run("missing template fails with name", func(t *testing.T) {
		err := NewCatalog().Register("golem15.hello", fsys, []string{"golem15.hello::mail.missing"}, nil)
		if err == nil || !strings.Contains(err.Error(), "golem15.hello::mail.missing") {
			t.Fatalf("missing template error = %v", err)
		}
	})
	t.Run("unknown layout fails with name", func(t *testing.T) {
		bad := fstest.MapFS{
			"views/mail/note.htm": {Data: []byte("subject = \"Hi\"\nlayout = \"plytarium\"\n==\nHi.\n")},
		}
		err := NewCatalog().Register("golem15.hello", bad, []string{"golem15.hello::mail.note"}, nil)
		if err == nil || !strings.Contains(err.Error(), "plytarium") {
			t.Fatalf("unknown layout error = %v", err)
		}
	})
	t.Run("missing layout file fails with full name", func(t *testing.T) {
		err := NewCatalog().Register("golem15.hello", fsys, nil, map[string]string{
			"hello": "golem15.hello::mail.layouts.missing",
		})
		if err == nil || !strings.Contains(err.Error(), "golem15.hello::mail.layouts.missing") {
			t.Fatalf("missing layout error = %v", err)
		}
	})
}