import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import test from "node:test";
import {
HTML_PREVIEW_CSP,
configureHtmlPreviewFrame,
htmlPreviewDocument,
} from "../web/static/js/preview_content.js";
// preview.js has browser-only top-level bindings, so exercise the integration contract
// through its shipped source and markup while keeping this test dependency-free.
const previewJs = readFileSync(new URL("../web/static/js/preview.js", import.meta.url), "utf8");
const pageHtml = readFileSync(new URL("../web/static/dev.html", import.meta.url), "utf8");
const chatJs = readFileSync(new URL("../web/static/js/chat.js", import.meta.url), "utf8");
test("HTML is a renderable category rather than plain text", () => {
assert.match(previewJs, /html:\s+new Set\(\["html","htm"\]\)/);
assert.match(previewJs, /configureHtmlPreviewFrame\(frame, text\)/);
});
test("HTML preview allows HTTPS scripts while blocking host privileges and navigation", () => {
const document = htmlPreviewDocument("xx");
assert.match(document, /"));
const attrs = {};
const frame = { setAttribute(name, value) { attrs[name] = value; } };
configureHtmlPreviewFrame(frame, "x
");
assert.equal(attrs.sandbox, "allow-scripts");
assert.doesNotMatch(attrs.sandbox, /allow-same-origin|allow-forms|allow-top-navigation|allow-popups/);
assert.equal(frame.referrerPolicy, "no-referrer");
});
test("HTML fragments receive a restrictive head before their content", () => {
const document = htmlPreviewDocument("报告
");
assert.match(document, /^报告<\/h1>$/);
});
test("main and mini previews expose preview/source mode controls", () => {
for (const prefix of ["fp", "mp"]) {
assert.match(pageHtml, new RegExp(`id="${prefix}-mode-preview"`));
assert.match(pageHtml, new RegExp(`id="${prefix}-mode-source"`));
assert.match(previewJs, new RegExp(`_showRenderableText\\("${prefix}", cat, text\\)`));
}
});
test("assistant HTML artifacts render inline with lazy loading and an expand action", () => {
const mediaJs = readFileSync(new URL("../web/static/js/media.js", import.meta.url), "utf8");
assert.match(mediaJs, /cat === "html"/);
assert.match(mediaJs, /class="art-html-open"/);
assert.match(mediaJs, /new IntersectionObserver/);
assert.match(mediaJs, /configureHtmlPreviewFrame\(frame, source/);
assert.match(pageHtml, /\.art-html-frame/);
assert.match(chatJs, /renderArtifactBarHtml\(extractArtifactRels\(p\.content, wd\), "html"\)/);
const clickHandler = chatJs.indexOf('$("chat-stream").addEventListener("click"');
const expandHandler = chatJs.indexOf('e.target.closest(".art-html-open[data-rel]")');
const sendMessage = chatJs.indexOf("async function sendMessage");
assert.ok(clickHandler >= 0 && expandHandler > clickHandler && expandHandler < sendMessage);
});