check-safety/frontend_test.go

package main

import (
	"os"
	"path/filepath"
	"testing"
)

func TestCheckPluginPagesFlagsQueryClientProvider(t *testing.T) {
	dir := t.TempDir()
	file := filepath.Join(dir, "editor.tsx")

	if err := os.WriteFile(file, []byte(`import { QueryClientProvider } from '@tanstack/react-query'

export function Editor() {
	return <QueryClientProvider client={client}><div /></QueryClientProvider>
}
`), 0644); err != nil {
		t.Fatalf("write editor.tsx: %v", err)
	}

	violations := checkPluginPages([]string{dir})
	found := false
	for _, v := range violations {
		if v.rule != "no-queryclientprovider-in-plugin" {
			continue
		}
		if v.snippet != "remove QueryClientProvider; BlockNinja core provides it." {
			t.Fatalf("snippet = %q, want concise remediation", v.snippet)
		}
		found = true
		break
	}

	if !found {
		t.Fatalf("expected QueryClientProvider violation, got %#v", violations)
	}
}

func TestCheckFrontendSkipsTestFiles(t *testing.T) {
	dir := t.TempDir()
	// A transport-layer regression test legitimately drives createClient over the
	// real transport to exercise interceptors — it is not shipped UI. The frontend
	// pattern checks must skip *.test.* / *.spec.* files, matching the convention
	// the coming-soon and TODO checks already follow.
	for _, name := range []string{"transport.test.ts", "auth.test.tsx", "util.spec.ts", "view.spec.tsx"} {
		if err := os.WriteFile(filepath.Join(dir, name), []byte(`import { createClient } from "@connectrpc/connect";
import axios from "axios";
const client = createClient(AuthService, transport);
`), 0644); err != nil {
			t.Fatalf("write %s: %v", name, err)
		}
	}

	violations, _ := checkFrontend(dir)
	if len(violations) != 0 {
		t.Fatalf("expected test/spec files to be skipped, got %d violation(s): %#v", len(violations), violations)
	}
}

func TestIsBrowserConfirmCall(t *testing.T) {
	tests := []struct {
		lines []string
		idx   int
		want  bool
	}{
		{lines: []string{`if (window.confirm("delete?")) {`}, idx: 0, want: true},
		{lines: []string{`if (confirm("delete?")) {`}, idx: 0, want: true},
		{lines: []string{`const confirmed = await confirm({ title: "Delete" })`}, idx: 0, want: false},
		{lines: []string{`confirm({ title: "Delete" }).then((confirmed) => {`}, idx: 0, want: false},
		{
			lines: []string{
				`const confirmed = await`,
				`  confirm({`,
				`    title: "Delete",`,
				`  })`,
			},
			idx:  1,
			want: false,
		},
		{
			lines: []string{
				`confirm({`,
				`  title: "Leave",`,
				`}).then((confirmed) => {`,
			},
			idx:  0,
			want: false,
		},
	}

	for _, tt := range tests {
		if got := isBrowserConfirmCall(tt.lines, tt.idx); got != tt.want {
			t.Fatalf("isBrowserConfirmCall(%#v, %d) = %v, want %v", tt.lines, tt.idx, got, tt.want)
		}
	}
}

func TestIsRawButtonJSXLine(t *testing.T) {
	tests := []struct {
		line string
		want bool
	}{
		{line: `<button>`, want: true},
		{line: `				<button`, want: true},
		{line: `<button className="h-8 w-8" onClick={onPick}>`, want: true},
		{line: `return <button type="button">{label}</button>`, want: true},
		{line: `<Button action="save">Save</Button>`, want: false},
		{line: `</button>`, want: false},
		{line: `{/* <button> is banned in admin UI */}`, want: false},
		{line: `<buttonish-element>`, want: false},
	}

	for _, tt := range tests {
		if got := isRawButtonJSXLine(tt.line); got != tt.want {
			t.Fatalf("isRawButtonJSXLine(%q) = %v, want %v", tt.line, got, tt.want)
		}
	}
}

func TestCheckFrontendFlagsRawButton(t *testing.T) {
	dir := t.TempDir()
	if err := os.MkdirAll(filepath.Join(dir, "components", "editor"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(dir, "components", "editor", "toolbar.tsx"), []byte(`export function Toolbar() {
	return (
		<div>
			<button onClick={save}>Save</button>
			<Button action="cancel">Cancel</Button>
		</div>
	)
}
`), 0o644); err != nil {
		t.Fatal(err)
	}

	violations, _ := checkFrontend(dir)
	var rawButton []frontendViolation
	for _, v := range violations {
		if v.rule == "no-raw-button" {
			rawButton = append(rawButton, v)
		}
	}
	if len(rawButton) != 1 {
		t.Fatalf("expected exactly one no-raw-button violation, got %d: %#v", len(rawButton), violations)
	}
	if rawButton[0].line != 4 {
		t.Fatalf("violation line = %d, want 4", rawButton[0].line)
	}
}

func TestCheckFrontendRawButtonExemptions(t *testing.T) {
	dir := t.TempDir()
	if err := os.MkdirAll(filepath.Join(dir, "components", "ui"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(filepath.Join(dir, "lib"), 0o755); err != nil {
		t.Fatal(err)
	}

	// The Button primitive itself renders a raw <button> — components/ui/ is exempt.
	if err := os.WriteFile(filepath.Join(dir, "components", "ui", "button.tsx"), []byte(`const Comp = asChild ? Slot : "button";
return <button className={cn(buttonVariants({ variant, size, className }))} ref={ref} {...props} />
`), 0o644); err != nil {
		t.Fatal(err)
	}

	// Non-React surfaces build DOM via HTML strings in plain .ts — <Button> does not exist there.
	if err := os.WriteFile(filepath.Join(dir, "lib", "iframe-script.ts"), []byte("const html = `<button class=\"bn-edit\">Edit</button>`\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	violations, _ := checkFrontend(dir)
	for _, v := range violations {
		if v.rule == "no-raw-button" {
			t.Fatalf("expected no no-raw-button violations, got %#v", v)
		}
	}
}

func TestCheckPluginPagesFlagsRawButton(t *testing.T) {
	dir := t.TempDir()
	if err := os.WriteFile(filepath.Join(dir, "settings.tsx"), []byte(`export function Settings() {
	return <button onClick={connect}>Connect</button>
}
`), 0o644); err != nil {
		t.Fatal(err)
	}

	violations := checkPluginPages([]string{dir})
	found := false
	for _, v := range violations {
		if v.rule == "no-raw-button-in-plugin" {
			found = true
			break
		}
	}
	if !found {
		t.Fatalf("expected no-raw-button-in-plugin violation, got %#v", violations)
	}
}

func TestPluginRESTFileAllowed(t *testing.T) {
	if !pluginRESTFileAllowed("/tmp/repo/backend/internal/plugins/calcomblock/web/settings.tsx") {
		t.Fatalf("expected documented calcom settings panel to be allowlisted")
	}
	if !pluginRESTFileAllowed("/tmp/repo/backend/internal/plugins/calcomblock/web/editor.tsx") {
		t.Fatalf("expected documented calcom editor panel to be allowlisted")
	}
	if pluginRESTFileAllowed("/tmp/repo/backend/internal/plugins/calcomblock/web/dashboard.tsx") {
		t.Fatalf("unexpected allowlist hit for non-allowlisted plugin file")
	}
}