Reklamator/tests/integration/test_markdown_rendering.py

"""
Integration tests for markdown rendering in feedback detail pages.

These tests verify end-to-end behavior: from accessing the detail route
through to seeing properly formatted HTML in the response.
"""

import pytest
from flask import url_for


# Skip all tests if markdown_utils not yet implemented
try:
    from app.utils.markdown_utils import markdown_filter
    MARKDOWN_UTILS_EXISTS = True
except ImportError:
    MARKDOWN_UTILS_EXISTS = False


pytestmark = pytest.mark.skipif(
    not MARKDOWN_UTILS_EXISTS,
    reason="markdown_utils module not yet implemented"
)


@pytest.fixture
def sample_feedback_with_markdown(authenticated_owner_client, app):
    """Create a feedback item with markdown-formatted AI analysis."""
    from app.models.feedback import Feedback
    import os

    feedback_id = "test-md-001"
    product_id = "prod_0001"

    # Create feedback using correct API
    feedback = Feedback(
        feedback_id=feedback_id,
        product_id=product_id,
        content_preview="Test feedback for markdown rendering"
    )
    feedback.save_metadata()

    # Save content
    feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
    content_file = os.path.join(feedback_dir, 'content.txt')
    with open(content_file, 'w') as f:
        f.write("Test feedback for markdown rendering")

    # Save analysis
    analysis_content = """## Summary

The customer feedback is **highly positive** with some *minor concerns*.

### Key Points

- Easy to use
- Great performance
- Excellent support

### Recommendations

1. Improve documentation
2. Add more features
3. Fix known bugs

### Technical Details

The system uses `Flask` framework with the following code:

```python
@app.route('/dashboard')
def dashboard():
    return render_template('dashboard.html')
```

### External References

See [Flask Documentation](https://flask.palletsprojects.com/) for more info.

### Data Summary

| Metric    | Value |
|-----------|-------|
| Score     | 9/10  |
| Sentiment | Positive |
"""
    analysis_file = os.path.join(feedback_dir, 'analysis.md')
    with open(analysis_file, 'w') as f:
        f.write(analysis_content)

    yield feedback

    # Cleanup
    import shutil
    if os.path.exists(feedback_dir):
        shutil.rmtree(feedback_dir)


@pytest.fixture
def sample_feedback_with_xss_attempt(authenticated_owner_client, app):
    """Create feedback with XSS attempt in analysis for security testing."""
    from app.models.feedback import Feedback
    import os

    feedback_id = "test-xss-001"
    product_id = "prod_0001"

    # Create feedback using correct API
    feedback = Feedback(
        feedback_id=feedback_id,
        product_id=product_id,
        content_preview="Test feedback"
    )
    feedback.save_metadata()

    # Save content
    feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
    content_file = os.path.join(feedback_dir, 'content.txt')
    with open(content_file, 'w') as f:
        f.write("Test feedback")

    # Analysis with XSS attempts
    analysis_content = """## Analysis

This is safe content.

<script>alert('XSS attempt')</script>

<iframe src="http://evil.com"></iframe>

**Bold text** is fine.

<a href="javascript:alert('xss')">Bad link</a>

![Image](http://example.com/img.png)
"""
    analysis_file = os.path.join(feedback_dir, 'analysis.md')
    with open(analysis_file, 'w') as f:
        f.write(analysis_content)

    yield feedback

    # Cleanup
    import shutil
    if os.path.exists(feedback_dir):
        shutil.rmtree(feedback_dir)


class TestMarkdownRenderingIntegration:
    """Test markdown rendering in full feedback detail page context."""

    def test_feedback_detail_renders_markdown_headings(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Feedback detail page renders markdown headings as HTML."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )

        assert response.status_code == 200
        html = response.data.decode('utf-8')

        # Check headings are rendered
        assert "<h2>Summary</h2>" in html
        assert "<h3>Key Points</h3>" in html
        assert "<h3>Recommendations</h3>" in html

        # Raw markdown should NOT appear
        assert "## Summary" not in html
        assert "### Key Points" not in html

    def test_feedback_detail_renders_markdown_emphasis(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Feedback detail page renders bold and italic text."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Check emphasis is rendered
        assert "<strong>highly positive</strong>" in html
        assert "<em>minor concerns</em>" in html

        # Raw markdown should NOT appear
        assert "**highly positive**" not in html
        assert "*minor concerns*" not in html

    def test_feedback_detail_renders_markdown_lists(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Feedback detail page renders lists as HTML."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Check unordered list
        assert "<ul>" in html
        assert "<li>Easy to use</li>" in html
        assert "<li>Great performance</li>" in html

        # Check ordered list
        assert "<ol>" in html
        assert "<li>Improve documentation</li>" in html
        assert "<li>Add more features</li>" in html

    def test_feedback_detail_renders_code_blocks(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Feedback detail page renders code blocks with proper formatting."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Check inline code
        assert "<code>Flask</code>" in html

        # Check code block (code is HTML-escaped, so check for the function name)
        assert "@app.route" in html
        assert "def dashboard()" in html
        # Should be in pre or code tags
        assert ("<pre>" in html or "<code>" in html)

    def test_feedback_detail_renders_markdown_tables(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Feedback detail page renders tables as HTML."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Check table structure
        assert "<table>" in html
        assert "<thead>" in html
        assert "<tbody>" in html
        assert "<th>Metric</th>" in html or "<th>Value</th>" in html
        assert "<td>9/10</td>" in html or "<td>Positive</td>" in html

    def test_feedback_detail_renders_links_with_security(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Feedback detail page renders links with security attributes."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Check link exists
        assert 'href="https://flask.palletsprojects.com/"' in html or \
               'href="http://flask.palletsprojects.com/"' in html
        assert "Flask Documentation" in html

        # Check security attributes
        assert 'target="_blank"' in html
        assert 'rel="noopener noreferrer nofollow"' in html or \
               ('noopener' in html and 'noreferrer' in html and 'nofollow' in html)


class TestMarkdownSecurityIntegration:
    """Test security features in full page context."""

    def test_feedback_detail_removes_script_tags(
        self, authenticated_owner_client, sample_feedback_with_xss_attempt
    ):
        """T015: Feedback detail page removes script tags from analysis."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_xss_attempt.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Script tag and content should be removed
        assert "<script>" not in html.lower()
        assert "alert('XSS attempt')" not in html

        # Safe content should still render
        assert "<h2>Analysis</h2>" in html
        assert "<strong>Bold text</strong>" in html

    def test_feedback_detail_removes_iframes(
        self, authenticated_owner_client, sample_feedback_with_xss_attempt
    ):
        """T015: Feedback detail page removes iframe tags."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_xss_attempt.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Iframe should be removed
        assert "<iframe" not in html.lower()
        assert "evil.com" not in html

    def test_feedback_detail_removes_javascript_protocol(
        self, authenticated_owner_client, sample_feedback_with_xss_attempt
    ):
        """T015: Feedback detail page removes javascript: protocol from links."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_xss_attempt.feedback_id)
        )

        html = response.data.decode('utf-8')

        # JavaScript protocol should not appear in links
        assert "javascript:" not in html.lower()

    def test_feedback_detail_removes_images(
        self, authenticated_owner_client, sample_feedback_with_xss_attempt
    ):
        """T015: Feedback detail page removes image tags."""
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_xss_attempt.feedback_id)
        )

        html = response.data.decode('utf-8')

        # Image tag should be removed
        assert "<img" not in html.lower()


class TestMarkdownEdgeCasesIntegration:
    """Test edge cases in full page context."""

    def test_feedback_without_analysis_still_renders(
        self, authenticated_owner_client
    ):
        """T015: Feedback detail without analysis renders normally."""
        from app.models.feedback import Feedback
        import os
        import shutil

        feedback_id = "test-no-analysis"
        product_id = "prod_0001"

        # Create feedback using correct API
        feedback = Feedback(
            feedback_id=feedback_id,
            product_id=product_id,
            content_preview="Feedback without analysis"
        )
        feedback.save_metadata()

        # Save content
        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
        content_file = os.path.join(feedback_dir, 'content.txt')
        with open(content_file, 'w') as f:
            f.write("Feedback without analysis")

        # Don't create analysis.md file - testing without analysis

        try:
            response = authenticated_owner_client.get(
                url_for('dashboard.detail', feedback_id=feedback.feedback_id)
            )

            assert response.status_code == 200
            html = response.data.decode('utf-8')

            # Page should render without errors
            assert "Feedback without analysis" in html

            # Analysis section should be empty or have placeholder
            # (depends on template implementation)

        finally:
            if os.path.exists(feedback_dir):
                shutil.rmtree(feedback_dir)

    def test_feedback_with_empty_analysis_renders(
        self, authenticated_owner_client
    ):
        """T015: Feedback with empty analysis string renders normally."""
        from app.models.feedback import Feedback
        import os
        import shutil

        feedback_id = "test-empty-analysis"
        product_id = "prod_0001"

        # Create feedback using correct API
        feedback = Feedback(
            feedback_id=feedback_id,
            product_id=product_id,
            content_preview="Test feedback"
        )
        feedback.save_metadata()

        # Save content
        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
        content_file = os.path.join(feedback_dir, 'content.txt')
        with open(content_file, 'w') as f:
            f.write("Test feedback")

        # Save empty analysis
        analysis_file = os.path.join(feedback_dir, 'analysis.md')
        with open(analysis_file, 'w') as f:
            f.write("")

        try:
            response = authenticated_owner_client.get(
                url_for('dashboard.detail', feedback_id=feedback.feedback_id)
            )

            assert response.status_code == 200
            # Should not crash, even with empty analysis

        finally:
            if os.path.exists(feedback_dir):
                shutil.rmtree(feedback_dir)

    def test_feedback_with_very_long_analysis(
        self, authenticated_owner_client
    ):
        """T015: Feedback with very long markdown analysis renders within performance budget."""
        from app.models.feedback import Feedback
        import os
        import shutil
        import time

        feedback_id = "test-long-analysis"
        product_id = "prod_0001"

        # Create very long markdown
        long_analysis = "\n".join([
            f"## Section {i}\n\nThis is section {i} with **bold** and *italic* text.\n\n"
            f"- Point 1\n- Point 2\n- Point 3\n\n"
            f"| Column A | Column B |\n|----------|----------|\n| Value {i} | Data {i} |\n"
            for i in range(50)
        ])

        # Create feedback using correct API
        feedback = Feedback(
            feedback_id=feedback_id,
            product_id=product_id,
            content_preview="Test feedback"
        )
        feedback.save_metadata()

        # Save content
        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
        content_file = os.path.join(feedback_dir, 'content.txt')
        with open(content_file, 'w') as f:
            f.write("Test feedback")

        # Save long analysis
        analysis_file = os.path.join(feedback_dir, 'analysis.md')
        with open(analysis_file, 'w') as f:
            f.write(long_analysis)

        try:
            start_time = time.time()
            response = authenticated_owner_client.get(
                url_for('dashboard.detail', feedback_id=feedback.feedback_id)
            )
            end_time = time.time()

            assert response.status_code == 200

            # Performance check: should load within 2 seconds (per SC-005)
            load_time = end_time - start_time
            assert load_time < 2.0, f"Page load took {load_time:.2f}s, expected < 2.0s"

            html = response.data.decode('utf-8')

            # Verify content is rendered
            assert "<h2>Section 0</h2>" in html
            assert "<h2>Section 49</h2>" in html

        finally:
            if os.path.exists(feedback_dir):
                shutil.rmtree(feedback_dir)

    def test_feedback_with_malformed_markdown(
        self, authenticated_owner_client
    ):
        """T015: Feedback with malformed markdown renders without crashing."""
        from app.models.feedback import Feedback
        import os
        import shutil

        feedback_id = "test-malformed"
        product_id = "prod_0001"

        # Create feedback using correct API
        feedback = Feedback(
            feedback_id=feedback_id,
            product_id=product_id,
            content_preview="Test feedback"
        )
        feedback.save_metadata()

        # Save content
        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
        content_file = os.path.join(feedback_dir, 'content.txt')
        with open(content_file, 'w') as f:
            f.write("Test feedback")

        # Malformed markdown
        analysis_content = "## Heading\n[Unclosed link(http://example.com\n**Unclosed bold"
        analysis_file = os.path.join(feedback_dir, 'analysis.md')
        with open(analysis_file, 'w') as f:
            f.write(analysis_content)

        try:
            response = authenticated_owner_client.get(
                url_for('dashboard.detail', feedback_id=feedback.feedback_id)
            )

            assert response.status_code == 200
            # Should render without errors, even if formatting is imperfect

        finally:
            if os.path.exists(feedback_dir):
                shutil.rmtree(feedback_dir)


class TestMarkdownRenderingPerformance:
    """Test performance of markdown rendering."""

    def test_page_load_time_within_budget(
        self, authenticated_owner_client, sample_feedback_with_markdown
    ):
        """T015: Page with markdown analysis loads within 2 second budget (SC-005)."""
        import time

        # Warm-up request
        authenticated_owner_client.get(url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id))

        # Measured request
        start_time = time.time()
        response = authenticated_owner_client.get(
            url_for('dashboard.detail', feedback_id=sample_feedback_with_markdown.feedback_id)
        )
        end_time = time.time()

        assert response.status_code == 200

        load_time = end_time - start_time
        assert load_time < 2.0, f"Page load took {load_time:.2f}s, expected < 2.0s (SC-005)"