| from dream_customs.render import render_pact_card |
| from dream_customs.schema import PactCard |
|
|
|
|
| def test_render_pact_card_contains_core_fields(): |
| html = render_pact_card( |
| PactCard( |
| visitor_name="Late Elevator", |
| permit_id="DC-1", |
| contraband=["unfiled anxiety"], |
| risk_level="orange", |
| alliance_reading="The dream asks for a smaller start.", |
| practical_suggestion="Open one task ten minutes early.", |
| weird_task="Write the elevator an apology note.", |
| bedtime_release="Today the elevator has docked.", |
| ) |
| ) |
| assert "Late Elevator" in html |
| assert "Today's Pact" in html or "Today's Pact" in html |
| assert "<script" not in html.lower() |
|
|
|
|
| def test_render_pact_card_escapes_user_like_content(): |
| html = render_pact_card( |
| PactCard( |
| visitor_name="<bad>", |
| permit_id="DC-2", |
| contraband=["<script>alert(1)</script>"], |
| risk_level="green", |
| alliance_reading="Maybe this visitor wants a smaller morning.", |
| practical_suggestion="Drink water.", |
| weird_task="Salute the kettle.", |
| bedtime_release="The kettle is released.", |
| ) |
| ) |
| assert "<bad>" not in html |
| assert "<script" not in html.lower() |
|
|
