tests/agents/d3/test_templates_render.py

import re
import pytest
from app.agents.d3 import templates  # noqa: F401 (populate registry)
from app.agents.d3.registry import TEMPLATES

ALLOWED_HOSTS = (
    "https://d3js.org/d3.v7.min.js",
    "https://cdn.jsdelivr.net/npm/d3-sankey@0.12/dist/d3-sankey.min.js",
)


@pytest.mark.parametrize("tid", list(TEMPLATES.keys()))
def test_template_renders_self_contained(tid):
    t = TEMPLATES[tid]
    html = t.render(t.golden_sample)
    # data token fully replaced
    assert "__DATA__" not in html
    # golden data present as JSON
    assert t.golden_sample.model_dump_json()[:20] in html
    # every external src is on the allow-list
    for src in re.findall(r'src=["\']([^"\']+)["\']', html):
        if src.startswith("http"):
            assert any(src.startswith(h) for h in ALLOWED_HOSTS), f"{tid}: {src}"
    # every <script> block is syntactically parseable as JS-ish (no obvious truncation)
    scripts = re.findall(r"<script[^>]*>(.*?)</script>", html, re.DOTALL)
    assert scripts, f"{tid}: no inline script"