"""Contract tests for landing page routes"""
import pytest
import os
import yaml
@pytest.fixture
def test_products(app):
"""Create test products with various configurations"""
with app.app_context():
products_dir = os.path.join(app.config['DATA_DIR'], 'products')
# Product 1: Active with description
product1_dir = os.path.join(products_dir, 'product-001')
os.makedirs(product1_dir, exist_ok=True)
with open(os.path.join(product1_dir, 'config.yaml'), 'w') as f:
yaml.dump({
'product_id': 'product-001',
'name': 'Zebra Product',
'submission_url_slug': 'zebra-product',
'owner_language': 'en',
'assigned_owner_ids': [],
'status': 'active',
'description': 'A product for testing'
}, f)
# Product 2: Active without description
product2_dir = os.path.join(products_dir, 'product-002')
os.makedirs(product2_dir, exist_ok=True)
with open(os.path.join(product2_dir, 'config.yaml'), 'w') as f:
yaml.dump({
'product_id': 'product-002',
'name': 'Apple Product',
'submission_url_slug': 'apple-product',
'owner_language': 'en',
'assigned_owner_ids': [],
'status': 'active'
}, f)
# Product 3: Archived (should not appear)
product3_dir = os.path.join(products_dir, 'product-003')
os.makedirs(product3_dir, exist_ok=True)
with open(os.path.join(product3_dir, 'config.yaml'), 'w') as f:
yaml.dump({
'product_id': 'product-003',
'name': 'Archived Product',
'submission_url_slug': 'archived-product',
'owner_language': 'en',
'assigned_owner_ids': [],
'status': 'archived',
'description': 'This product is archived'
}, f)
# Product 4: Active but missing slug (should not appear)
product4_dir = os.path.join(products_dir, 'product-004')
os.makedirs(product4_dir, exist_ok=True)
with open(os.path.join(product4_dir, 'config.yaml'), 'w') as f:
yaml.dump({
'product_id': 'product-004',
'name': 'No Slug Product',
'submission_url_slug': '',
'owner_language': 'en',
'assigned_owner_ids': [],
'status': 'active',
'description': 'Product with missing slug'
}, f)
# Product 5: XSS test product
product5_dir = os.path.join(products_dir, 'product-005')
os.makedirs(product5_dir, exist_ok=True)
with open(os.path.join(product5_dir, 'config.yaml'), 'w') as f:
yaml.dump({
'product_id': 'product-005',
'name': 'Evil Product',
'submission_url_slug': 'xss-product',
'owner_language': 'en',
'assigned_owner_ids': [],
'status': 'active',
'description': '
Malicious description'
}, f)
yield
@pytest.mark.contract
def test_get_landing_page_with_products(client, test_products):
"""T002: GET / with active products returns 200 with product list HTML"""
response = client.get('/')
assert response.status_code == 200
assert b'' not in html, "Script tag not escaped in product name"
assert 'alert("xss")' not in html or '<script>' in html, "XSS vulnerability in product name"
# Image onerror should be escaped
assert '