//! Structured fuzz over the custom-pages HTML sanitizer.
//!
//! Row 1 of `astra-soak-overview`, and the one named there as most likely to
//! find something: this is the filter standing between creator-authored HTML
//! and every reader of a public page, so a finding here is a security finding
//! rather than a robustness one.
//!
//! ## The oracle lives in the crate, not here
//!
//! Everything asserted is `custom_pages::oracle::check_html`. The committed
//! replay in `tests/regressions.rs` calls the same function on stable, so a
//! crash found here becomes a permanent test by copying one file into
//! `fuzz/regressions/`, and neither side can drift into checking less than the
//! other. The shape is `MNW/shared/git-command`'s, copied deliberately.
//!
//! What it asserts, over output and never over input: the safety floor (nothing
//! executable survives -- no `<script>`, no `on*` handler, no `javascript:`),
//! the closed system (no URL survives that resolves off-platform), and
//! idempotence of `sanitize_html`. The last is the mutation-XSS property, where
//! a second parse of the same bytes sees markup the first pass did not emit.
//!
//! Not-panicking is the weakest thing a fuzz target can assert, and a target
//! that asserts only that reports clean forever while the allowlist quietly
//! starts letting an `onerror` through.
//!
//! ## The policy is a fixture, not fuzzed input
//!
//! `UrlPolicy` is configuration the server supplies, not something an attacker
//! reaches. Fuzzing it would spend the budget on host lists nobody deploys and
//! would make every finding ambiguous between "the sanitizer is wrong" and
//! "this policy was nonsense". It is the same fixture `tests/regressions.rs`
//! uses, so a crash replays there unchanged.

#![no_main]

use libfuzzer_sys::fuzz_target;
use std::sync::LazyLock;

/// The owner scope woven into the canvas selector. Any fixed UUID does; this is
/// the one the regression replay uses.
static POLICY: LazyLock<custom_pages::UrlPolicy> = LazyLock::new(|| {
    custom_pages::UrlPolicy::new(
        "https://u.makenot.work/alice/proj",
        [
            "makenot.work".to_string(),
            "u.makenot.work".to_string(),
            "cdn.makenot.work".to_string(),
        ],
    )
    .expect("the fixture policy is well-formed")
});

fuzz_target!(|input: &str| {
    custom_pages::oracle::check_html(input, &POLICY);
});