Elternbeirat/Elternbeirat.Web.Tests/RouteSmokeTests.cs

using System.Net;
using System.Text.RegularExpressions;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.AspNetCore.TestHost;
using Microsoft.Extensions.DependencyInjection;

namespace Elternbeirat.Web.Tests;

/// <summary>
/// Smoke tests: every known route must return 200, unknown routes must return
/// 404. This catches broken content files, renamed slugs or routing regressions
/// before a deploy.
/// <para>
/// The post routes now read from PocketBase, so the tests point the web app at the
/// seeded container from <see cref="PocketBaseFixture"/> (shared via the
/// collection) and assert against its known slugs. Requires Docker, like the
/// client tests.
/// </para>
/// </summary>
[Collection(PocketBaseTestGroup.Name)]
public sealed partial class RouteSmokeTests : IDisposable
{
    // WithWebHostBuilder returns a new factory that wraps the base one; both are
    // disposable, so both are held and disposed to avoid leaking either.
    private readonly WebApplicationFactory<Program> _baseFactory = new();
    private readonly WebApplicationFactory<Program> _factory;

    public RouteSmokeTests(PocketBaseFixture pocketBase)
    {
        // Point the app's PocketBaseClient at the seeded test container instead of
        // the value from appsettings. UseSetting (not ConfigureAppConfiguration)
        // because it wins over appsettings.Development.json, which otherwise pins the
        // client to localhost:8090 while the test container uses a random port.
        _factory = WithClock(
            _baseFactory.WithWebHostBuilder(builder =>
                builder.UseSetting("PocketBase:BaseUrl", pocketBase.BaseUrl.ToString())),
            BeforeFixtureEvents);
    }

    /// <summary>
    /// "Now" for the default factory: a week before the fixture's first event, so
    /// "upcoming" stays true no matter when the tests run.
    /// </summary>
    private static readonly DateTimeOffset BeforeFixtureEvents = new(2026, 10, 1, 10, 0, 0, TimeSpan.Zero);

    /// <summary>
    /// Wraps <paramref name="factory"/> so the app's clock shows <paramref name="now"/>.
    /// </summary>
    private static WebApplicationFactory<Program> WithClock(WebApplicationFactory<Program> factory, DateTimeOffset now) =>
        factory.WithWebHostBuilder(builder =>
            builder.ConfigureTestServices(services => services.AddSingleton<TimeProvider>(new FixedTimeProvider(now))));

    public void Dispose()
    {
        _factory.Dispose();
        _baseFactory.Dispose();
    }

    /// <summary>
    /// Every route that a visitor can reach through the navigation, the FAQ hub
    /// or the news section. The post slugs match the fixture's seed.
    /// </summary>
    public static TheoryData<string> KnownRoutes =>
    [
        "/",
        "/board",
        "/patrons",
        "/faqs",
        "/faq-lunch",
        "/downloads",
        "/contact",
        "/imprint",
        "/privacy",
        "/posts",
        "/posts/new-board",
        "/posts/new-hall",
        "/events",
        "/events.ics",
    ];

    [Theory]
    [MemberData(nameof(KnownRoutes))]
    public async Task Known_route_returns_200(string route)
    {
        var client = _factory.CreateClient();

        var response = await client.GetAsync(new Uri(route, UriKind.Relative));

        response.StatusCode.ShouldBe(HttpStatusCode.OK);
    }

    [Theory]
    [InlineData("/gibt-es-nicht")]
    [InlineData("/posts/gibt-es-nicht")]
    public async Task Unknown_route_returns_404(string route)
    {
        var client = _factory.CreateClient();

        var response = await client.GetAsync(new Uri(route, UriKind.Relative));

        response.StatusCode.ShouldBe(HttpStatusCode.NotFound);
    }

    [Fact]
    public async Task Faqs_route_renders_the_topic_accordion()
    {
        // /faqs is a literal route (FaqList) that must win over the /{Slug}
        // catch-all content page. It reads the "faqs" page for heading and intro
        // and renders each topic as a collapsible group with its questions nested
        // inside, so both the topic headings and the questions are in the markup.
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/faqs", UriKind.Relative));

        html.ShouldContain("FAQs"); // heading from the page title
        html.ShouldContain("Mensa und Mittagessen"); // German topic heading (a group)
        html.ShouldContain("Wann gibt es Mittagessen?"); // a question nested in the group
    }

    [Fact]
    public async Task Layout_navigation_is_built_from_the_pages()
    {
        // The header and footer menus are generated from the "pages" records, not
        // hard-coded. Assert a header link, a footer link, and that the non-public
        // draft page never leaks into the menu.
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        html.ShouldContain("href=\"/board\""); // header page
        html.ShouldContain("href=\"/imprint\""); // footer page
        html.ShouldNotContain("href=\"/draft\""); // public=false, filtered out
    }

    [Fact]
    public async Task Footer_links_every_public_header_and_footer_page_in_order()
    {
        // The footer repeats the header pages as "Schnellzugriff" and then lists the
        // footer pages, each column in its order field. Only the <footer> is checked,
        // so the header menu cannot make the test pass on its own. The expected list
        // mirrors the fixture's pages; the draft (public=false) must be missing.
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        var footer = FooterElement().Match(html);
        footer.Success.ShouldBeTrue();
        var hrefs = Href().Matches(footer.Value).Select(match => match.Groups[1].Value);

        hrefs.ShouldBe(
        [
            "/", "/board", "/patrons", "/faqs", "/downloads", "/posts", "/events",
            "/contact", "/imprint", "/privacy", "/faq-lunch",
        ]);
        footer.Value.ShouldContain("Schnellzugriff");
        footer.Value.ShouldContain("Weiteres");
    }

    [Fact]
    public async Task Home_renders_the_embeds_its_page_opts_into()
    {
        // The home page's embed field is ["posts","events"], so the root route
        // renders the posts teaser and the events teaser below the intro.
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        html.ShouldContain("Aktuelle Beiträge"); // posts embed heading
        html.ShouldContain("Neuer Vorstand"); // a seeded post title
        html.ShouldContain("Kommende Termine"); // events embed heading
    }

    [Fact]
    public async Task Content_page_renders_its_body()
    {
        // /patrons is a catch-all content page (the /{Slug} route). Assert it renders
        // its Markdown body, proving the ContentPage path works for an arbitrary slug.
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/patrons", UriKind.Relative));

        html.ShouldContain("Der Förderverein unterstützt die Schule."); // the page body, rendered from Markdown
    }

    [Fact]
    public async Task Content_page_body_carries_the_markdown_styles_and_blocks()
    {
        // The editor-content styles in app.css all hang off .markdown-body, and the
        // design blocks off the class a ":::" container renders. Assert both reach
        // the markup of a real page, so a renamed wrapper or a pipeline without
        // custom containers fails here instead of silently unstyling the site.
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/patrons", UriKind.Relative));

        html.ShouldContain("class=\"markdown-body\"");
        html.ShouldContain("<div class=\"kennzahlen\">");
    }

    [Fact]
    public async Task Posts_and_events_render_their_page_heading_and_body()
    {
        // /posts and /events are served by PostList and EventList, which -- like
        // FaqList -- read their own "posts"/"events" page record for heading and
        // intro instead of hard-coding them. Assert both the title (as the h1) and
        // the body text from the fixture records reach the markup.
        var client = _factory.CreateClient();

        var posts = await client.GetStringAsync(new Uri("/posts", UriKind.Relative));
        posts.ShouldContain("Beiträge"); // heading from the page title
        posts.ShouldContain("Neuigkeiten aus dem Elternbeirat."); // the page body

        var events = await client.GetStringAsync(new Uri("/events", UriKind.Relative));
        events.ShouldContain("Termine"); // heading from the page title
        events.ShouldContain("Sitzungen und Veranstaltungen auf einen Blick."); // the page body
    }

    [Theory]
    [InlineData("/app.css")]
    [InlineData("/")]
    public async Task No_resource_is_loaded_from_a_foreign_host(string route)
    {
        // Privacy rule (docs/recht.md): nothing may make the visitor's browser contact
        // a third-party host -- no Google Fonts, no CDN. Check the stylesheet and the
        // rendered home page for anything that LOADS from an absolute URL (src,
        // srcset, <link href>, CSS url() and @import). Plain <a href> links are left
        // alone on purpose: an editor may link to another site, and a link loads
        // nothing until the visitor clicks it.
        var client = _factory.CreateClient();

        var body = await client.GetStringAsync(new Uri(route, UriKind.Relative));

        ForeignResource().Matches(body).Select(match => match.Value).ShouldBeEmpty();
    }

    [Fact]
    public async Task Site_font_is_self_hosted()
    {
        // The @font-face must point at our own wwwroot with a relative URL, and the
        // file must actually be served -- otherwise every visitor silently falls back
        // to the system font.
        var client = _factory.CreateClient();

        var css = await client.GetStringAsync(new Uri("/app.css", UriKind.Relative));
        css.ShouldContain("url(\"fonts/nunito-latin-wght.woff2\")");

        var font = await client.GetAsync(new Uri("/fonts/nunito-latin-wght.woff2", UriKind.Relative));
        font.StatusCode.ShouldBe(HttpStatusCode.OK);
    }

    [Fact]
    public async Task Health_returns_200_when_PocketBase_is_reachable()
    {
        // The monitor's happy path: the app answers and PocketBase (the seeded
        // fixture) is up, so /health is 200. This mostly guards the wiring -- that the
        // endpoint exists and reaches the client -- since the fixture keeps PocketBase
        // alive; the unreachable case is covered separately below.
        var client = _factory.CreateClient();

        var response = await client.GetAsync(new Uri("/health", UriKind.Relative));

        response.StatusCode.ShouldBe(HttpStatusCode.OK);
    }

    [Fact]
    public async Task Health_returns_503_when_PocketBase_is_unreachable()
    {
        // The case the monitor exists for: the app is up but PocketBase is not. Point a
        // throwaway app at a dead address (nothing listens on port 1, so the probe is
        // refused at once, no timeout wait) and assert /health reports 503 rather than
        // claiming healthy.
        await using var factory = _baseFactory.WithWebHostBuilder(builder =>
            builder.UseSetting("PocketBase:BaseUrl", "http://localhost:1"));
        var client = factory.CreateClient();

        var response = await client.GetAsync(new Uri("/health", UriKind.Relative));

        response.StatusCode.ShouldBe(HttpStatusCode.ServiceUnavailable);
    }

    [Fact]
    public async Task Home_hero_takes_title_and_buttons_from_the_body()
    {
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        html.ShouldContain(">Willkommen</h1>");
        html.ShouldNotContain(">Elternbeirat der IGMH</h1>"); // the fallback title
        html.ShouldContain("""<a class="btn btn-primary" href="/events">""");
        html.ShouldContain("""<a class="btn btn-secondary" href="/contact">""");
    }

    [Fact]
    public async Task Home_tiles_are_exactly_the_public_header_pages()
    {
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        var tiles = HomeTiles().Match(html);
        tiles.Success.ShouldBeTrue();
        Href().Matches(tiles.Value).Select(match => match.Groups[1].Value)
            .ShouldBe(["/board", "/patrons", "/faqs", "/downloads", "/posts", "/events"]);
    }

    [Fact]
    public async Task Home_shows_the_next_event_when_one_is_upcoming()
    {
        var client = _factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        html.ShouldContain("Nächster Termin");
        html.ShouldContain("Elternbeiratssitzung");
    }

    [Fact]
    public async Task Home_hides_the_next_event_when_none_is_upcoming()
    {
        // After the fixture's last event nothing is upcoming; the card must vanish
        // instead of showing an empty frame.
        await using var factory = WithClock(_factory, new DateTimeOffset(2027, 1, 1, 10, 0, 0, TimeSpan.Zero));
        var client = factory.CreateClient();

        var html = await client.GetStringAsync(new Uri("/", UriKind.Relative));

        html.ShouldNotContain("Nächster Termin");
    }

    /// <summary>
    /// Matches a resource reference that points at an absolute URL, with or without
    /// scheme (<c>https://</c>, <c>http://</c> or protocol-relative <c>//</c>): the
    /// <c>src</c>/<c>srcset</c> attributes, a <c>&lt;link&gt;</c>'s <c>href</c>, CSS
    /// <c>url()</c> and <c>@import</c>.
    /// </summary>
    [GeneratedRegex("""(?:\b(?:src|srcset)\s*=\s*|<link\b[^>]*\bhref\s*=\s*|url\(\s*|@import\s+)["']?\s*(?:https?:)?//""", RegexOptions.IgnoreCase)]
    private static partial Regex ForeignResource();

    /// <summary>
    /// Matches the page's <c>&lt;footer&gt;</c> element, from its opening tag to the
    /// closing one. The layout renders exactly one footer and nests no other.
    /// </summary>
    [GeneratedRegex("""<footer\b.*?</footer>""", RegexOptions.Singleline)]
    private static partial Regex FooterElement();

    /// <summary>
    /// Matches an <c>href</c> attribute and captures its value.
    /// </summary>
    [GeneratedRegex(@"\bhref=""([^""]*)""")]
    private static partial Regex Href();

    /// <summary>
    /// Matches the home page's tile section, from its opening tag to the closing
    /// one. It nests no other <c>&lt;section&gt;</c>.
    /// </summary>
    [GeneratedRegex("""<section class="home-tiles".*?</section>""", RegexOptions.Singleline)]
    private static partial Regex HomeTiles();
}