package main

import (
	"bytes"
	"html/template"
	"strings"
	"testing"

	"cmautobuy/admin/service"
)

func TestPddImportResultTemplate_完整集合和失败明细安全渲染(t *testing.T) {
	tmpl, err := template.ParseFS(templateFS, "templates/*/*.html")
	if err != nil {
		t.Fatal(err)
	}
	var output bytes.Buffer
	data := map[string]any{
		"Title": "PDD 商品", "Active": "pdd", "CSRFToken": "test-csrf",
		"ImportResult": &service.PddImportResult{
			TotalRows: 25, CreatedCount: 2, ExistingCount: 1, DuplicateCount: 1,
			GoodsIDs: []string{"737116531267", "647453710994"},
			Failures: []service.PddImportFailure{{
				Row: 5, Raw: "<script>alert(1)</script>", Reason: "不是拼多多网址",
			}},
		},
	}
	if err := tmpl.ExecuteTemplate(&output, "pdd/list", data); err != nil {
		t.Fatalf("渲染 PDD 导入结果失败: %v", err)
	}
	body := output.String()
	for _, want := range []string{
		"本次导入结果", "总行数 <strong>25</strong>",
		`data-collect-form="pdd-import-collect-form"`,
		`name="ids" value="737116531267"`,
		`name="ids" value="647453710994"`,
		"Excel 行号", "不是拼多多网址", "&lt;script&gt;alert(1)&lt;/script&gt;",
	} {
		if !strings.Contains(body, want) {
			t.Errorf("导入结果页面缺少 %q", want)
		}
	}
	if strings.Contains(body, "<script>alert(1)</script>") {
		t.Error("Excel 原始内容没有经过 html/template 自动转义")
	}
}