cmroubao/backend-api/internal/transport/webui/handler_test.go

package webui

import (
	"bytes"
	"context"
	"errors"
	"io"
	"mime/multipart"
	"net/http"
	"net/http/httptest"
	"net/url"
	"regexp"
	"strings"
	"testing"
	"time"

	"cmroubao/backend-api/internal/usecase"

	"github.com/gin-gonic/gin"
)

const testTaskID = "00000000-0000-4000-8000-000000000001"

func TestListTasksRendersRealRowsEscapedWithSecurityHeaders(t *testing.T) {
	now := time.Date(2026, 7, 26, 3, 4, 5, 0, time.UTC)
	service := &fakeService{
		listResult: TaskList{Items: []TaskSummary{{
			ID:        testTaskID,
			Title:     `<script>alert("private")</script>`,
			SKU:       "SKU-1",
			Status:    "PENDING",
			UpdatedAt: now,
		}}},
	}
	router := newTestRouter(t, service)

	response := performRequest(
		t,
		router,
		http.MethodGet,
		"/tasks?q=%3Cquery%3E&status=PENDING",
		nil,
		"",
	)

	if response.Code != http.StatusOK {
		t.Fatalf("status = %d, body = %s", response.Code, response.Body)
	}
	body := response.Body.String()
	if strings.Contains(body, `<script>alert("private")</script>`) ||
		!strings.Contains(body, "&lt;script&gt;") {
		t.Fatalf("task title was not safely escaped: %s", body)
	}
	for _, text := range []string{
		"SKU-1",
		"待领取",
		"/tasks/" + testTaskID,
		"value=\"&lt;query&gt;\"",
	} {
		if !strings.Contains(body, text) {
			t.Fatalf("body does not contain %q", text)
		}
	}
	assertSecurityHeaders(t, response)
	if service.listInput.Query != "<query>" ||
		service.listInput.Status != "PENDING" ||
		service.listInput.Limit != defaultListLimit {
		t.Fatalf("list input = %+v", service.listInput)
	}
}

func TestListTasksRendersHonestEmptyState(t *testing.T) {
	router := newTestRouter(t, &fakeService{})
	response := performRequest(
		t,
		router,
		http.MethodGet,
		"/tasks",
		nil,
		"",
	)

	if response.Code != http.StatusOK {
		t.Fatalf("status = %d", response.Code)
	}
	body := response.Body.String()
	if !strings.Contains(body, "没有符合条件的任务") ||
		!strings.Contains(body, "创建第一条采购任务") {
		t.Fatalf("empty state missing: %s", body)
	}
	for _, fake := range []string{"RB-DEMO", "演示设备", "演示任务"} {
		if strings.Contains(body, fake) {
			t.Fatalf("empty page contains fake data %q", fake)
		}
	}
}

func TestNewTaskIssuesReusableStrictCSRFCookie(t *testing.T) {
	router := newTestRouter(t, &fakeService{})
	response := performRequest(
		t,
		router,
		http.MethodGet,
		"/tasks/new",
		nil,
		"",
	)

	if response.Code != http.StatusOK {
		t.Fatalf("status = %d, body = %s", response.Code, response.Body)
	}
	cookie := csrfCookie(t, response)
	if !cookie.HttpOnly ||
		cookie.SameSite != http.SameSiteStrictMode ||
		cookie.Path != "/" {
		t.Fatalf("CSRF cookie = %+v", cookie)
	}
	body := response.Body.String()
	if !strings.Contains(
		body,
		`name="csrf_token" value="`+cookie.Value+`"`,
	) {
		t.Fatal("form CSRF token does not match the cookie")
	}
	for _, required := range []string{
		`name="title"`,
		`name="sku"`,
		`name="quantity"`,
		`name="max_budget"`,
		`name="image"`,
		`action="/logout"`,
		"最高总预算",
	} {
		if !strings.Contains(body, required) {
			t.Fatalf("new task form missing %q", required)
		}
	}
	if strings.Contains(body, "<style") ||
		strings.Contains(body, "<script>") {
		t.Fatal("page contains inline style or script incompatible with CSP")
	}
	assertSecurityHeaders(t, response)
}

func TestNewTaskPrefersRootCSRFCookieDuringLegacyPathMigration(
	t *testing.T,
) {
	router := newTestRouter(t, &fakeService{})
	legacy := mustToken(t)
	root := mustToken(t)
	for root == legacy {
		root = mustToken(t)
	}
	request := httptest.NewRequest(http.MethodGet, "/tasks/new", nil)
	request.AddCookie(&http.Cookie{
		Name:  csrfCookieName,
		Value: legacy,
		Path:  "/tasks",
	})
	request.AddCookie(&http.Cookie{
		Name:  csrfCookieName,
		Value: root,
		Path:  "/",
	})
	response := httptest.NewRecorder()

	router.ServeHTTP(response, request)

	if response.Code != http.StatusOK ||
		!strings.Contains(
			response.Body.String(),
			`name="csrf_token" value="`+root+`"`,
		) {
		t.Fatalf("status/body = %d / %s", response.Code, response.Body)
	}
}

func TestCreateTaskRejectsCSRFBeforeCallingService(t *testing.T) {
	service := &fakeService{}
	router := newTestRouter(t, service)
	body, contentType := multipartBody(t, map[string]string{
		"csrf_token": "invalid",
		"title":      "标题",
		"sku":        "SKU-1",
		"quantity":   "1",
		"upload_key": mustToken(t),
		"create_key": mustToken(t),
	}, "image", "reference.jpg", []byte("not inspected"))

	response := performRequest(
		t,
		router,
		http.MethodPost,
		"/tasks",
		body,
		contentType,
	)

	if response.Code != http.StatusForbidden {
		t.Fatalf("status = %d, body = %s", response.Code, response.Body)
	}
	if service.uploadCalls != 0 || service.createCalls != 0 {
		t.Fatalf(
			"service calls = upload %d, create %d",
			service.uploadCalls,
			service.createCalls,
		)
	}
}

func TestCreateTaskValidationRetainsEscapedSafeFields(t *testing.T) {
	service := &fakeService{}
	router := newTestRouter(t, service)
	cookie := getCSRFCookie(t, router)
	body, contentType := multipartBody(t, map[string]string{
		"csrf_token":  cookie.Value,
		"title":       "",
		"sku":         "",
		"description": `<img src=x onerror="alert(1)">`,
		"quantity":    "0",
		"max_budget":  "1.001",
		"upload_key":  mustToken(t),
		"create_key":  mustToken(t),
	}, "", "", nil)
	request := httptest.NewRequest(http.MethodPost, "/tasks", body)
	request.Header.Set("Content-Type", contentType)
	request.AddCookie(cookie)
	response := httptest.NewRecorder()

	router.ServeHTTP(response, request)

	if response.Code != http.StatusUnprocessableEntity {
		t.Fatalf("status = %d, body = %s", response.Code, response.Body)
	}
	rendered := response.Body.String()
	for _, message := range []string{
		"请输入商品标题",
		"请输入 SKU",
		"数量必须是大于 0 的整数",
		"最多两位小数",
		"&lt;img src=x onerror=&#34;alert(1)&#34;&gt;",
	} {
		if !strings.Contains(rendered, message) {
			t.Fatalf("response missing %q", message)
		}
	}
	if strings.Contains(rendered, `<img src=x onerror="alert(1)">`) {
		t.Fatal("description was rendered as active HTML")
	}
	if service.uploadCalls != 0 || service.createCalls != 0 {
		t.Fatal("invalid form reached the service")
	}
}

func TestCreateValidationUsesContractUTF8ByteLimits(t *testing.T) {
	valid := func() newTaskPageView {
		token := mustToken(t)
		return newTaskPageView{
			CSRFToken: token,
			UploadKey: mustToken(t),
			CreateKey: mustToken(t),
			Form: createFormView{
				Title:         "标题",
				SKU:           "SKU-1",
				Quantity:      "1",
				QuantityValue: 1,
			},
		}
	}

	skuPage := valid()
	skuPage.Form.SKU = strings.Repeat("货", maxSKUBytes/3+1)
	if !validateCreateForm(&skuPage) ||
		!strings.Contains(skuPage.Errors.SKU, "512") {
		t.Fatalf("SKU errors = %+v", skuPage.Errors)
	}

	descriptionPage := valid()
	descriptionPage.Form.Description = strings.Repeat(
		"说",
		maxDescriptionBytes/3+1,
	)
	if !validateCreateForm(&descriptionPage) ||
		!strings.Contains(descriptionPage.Errors.Description, "8192") {
		t.Fatalf("description errors = %+v", descriptionPage.Errors)
	}

	titlePage := valid()
	titlePage.Form.Title = strings.Repeat("题", maxTitleRunes+1)
	if !validateCreateForm(&titlePage) ||
		!strings.Contains(titlePage.Errors.Title, "120") {
		t.Fatalf("title errors = %+v", titlePage.Errors)
	}

	if maxRequestBytes < (20<<20)+(1<<20) {
		t.Fatalf("maxRequestBytes = %d, does not cover a 20 MiB image", maxRequestBytes)
	}
}

func TestCreateTaskUploadsThenRedirectsWithPRG(t *testing.T) {
	service := &fakeService{
		uploadResult: UploadedAsset{
			ID: "00000000-0000-4000-8000-000000000099",
		},
		createResult: Task{ID: testTaskID},
	}
	router := newTestRouter(t, service)
	cookie := getCSRFCookie(t, router)
	body, contentType := multipartBody(t, map[string]string{
		"csrf_token":  cookie.Value,
		"title":       "  桌面收纳盒  ",
		"sku":         "  SKU-1  ",
		"description": "浅灰色",
		"quantity":    "2",
		"max_budget":  "60.00",
		"upload_key":  mustToken(t),
		"create_key":  mustToken(t),
	}, "image", "reference.jpg", []byte("image bytes"))
	request := httptest.NewRequest(http.MethodPost, "/tasks", body)
	request.Header.Set("Content-Type", contentType)
	request.AddCookie(cookie)
	response := httptest.NewRecorder()

	router.ServeHTTP(response, request)

	if response.Code != http.StatusSeeOther ||
		response.Header().Get("Location") != "/tasks/"+testTaskID {
		t.Fatalf(
			"status/location = %d/%q, body = %s",
			response.Code,
			response.Header().Get("Location"),
			response.Body,
		)
	}
	if service.uploadCalls != 1 || service.createCalls != 1 {
		t.Fatalf(
			"service calls = upload %d, create %d",
			service.uploadCalls,
			service.createCalls,
		)
	}
	if string(service.uploadBody) != "image bytes" ||
		service.createInput.Title != "桌面收纳盒" ||
		service.createInput.SKU != "SKU-1" ||
		service.createInput.Quantity != 2 ||
		service.createInput.MaxBudget != "60.00" ||
		service.createInput.ImageAssetID != service.uploadResult.ID {
		t.Fatalf(
			"upload/create input = %q / %+v",
			service.uploadBody,
			service.createInput,
		)
	}
}

func TestCreateTaskFailureRetainsUploadedAssetForRetry(t *testing.T) {
	assetID := "00000000-0000-4000-8000-000000000099"
	service := &fakeService{
		uploadResult: UploadedAsset{
			ID: assetID,
		},
		createErr: ErrUnavailable,
	}
	router := newTestRouter(t, service)
	cookie := getCSRFCookie(t, router)
	body, contentType := validCreateBody(t, cookie.Value, nil)
	request := httptest.NewRequest(http.MethodPost, "/tasks", body)
	request.Header.Set("Content-Type", contentType)
	request.AddCookie(cookie)
	response := httptest.NewRecorder()

	router.ServeHTTP(response, request)

	if response.Code != http.StatusServiceUnavailable {
		t.Fatalf("status = %d, body = %s", response.Code, response.Body)
	}
	rendered := response.Body.String()
	for _, value := range []string{
		`name="image_asset_id" value="` + assetID + `"`,
		"再次提交会复用该图片",
	} {
		if !strings.Contains(rendered, value) {
			t.Fatalf("response missing %q", value)
		}
	}
	if strings.Contains(rendered, "reference.jpg") {
		t.Fatal("server response leaked the client file name")
	}
}

func TestCreateTaskRetryReusesAssetWithoutUpload(t *testing.T) {
	assetID := "00000000-0000-4000-8000-000000000099"
	service := &fakeService{
		createResult: Task{ID: testTaskID},
	}
	router := newTestRouter(t, service)
	cookie := getCSRFCookie(t, router)
	body, contentType := validCreateBody(t, cookie.Value, map[string]string{
		"image_asset_id": assetID,
	})
	request := httptest.NewRequest(http.MethodPost, "/tasks", body)
	request.Header.Set("Content-Type", contentType)
	request.AddCookie(cookie)
	response := httptest.NewRecorder()

	router.ServeHTTP(response, request)

	if response.Code != http.StatusSeeOther {
		t.Fatalf("status = %d, body = %s", response.Code, response.Body)
	}
	if service.uploadCalls != 0 ||
		service.createInput.ImageAssetID != assetID {
		t.Fatalf(
			"upload calls / asset = %d / %q",
			service.uploadCalls,
			service.createInput.ImageAssetID,
		)
	}
}

func TestTaskDetailPendingCancelUsesCSRFAndPRG(t *testing.T) {
	service := &fakeService{
		getResult: Task{
			ID:               testTaskID,
			Title:            "桌面收纳盒",
			SKU:              "SKU-1",
			Description:      "浅灰色",
			Quantity:         2,
			MaxBudget:        "60.00",
			Status:           "PENDING",
			ReferenceAssetID: "00000000-0000-4000-8000-000000000009",
			CreatedAt:        time.Date(2026, 7, 26, 3, 4, 5, 0, time.UTC),
			UpdatedAt:        time.Date(2026, 7, 26, 3, 5, 5, 0, time.UTC),
		},
		cancelResult: Task{Status: "CANCELED"},
	}
	router := newTestRouter(t, service)
	detail := performRequest(
		t,
		router,
		http.MethodGet,
		"/tasks/"+testTaskID,
		nil,
		"",
	)
	if detail.Code != http.StatusOK {
		t.Fatalf("detail status = %d, body = %s", detail.Code, detail.Body)
	}
	cookie := csrfCookie(t, detail)
	cancelKey := hiddenValue(t, detail.Body.String(), "cancel_key")
	for _, value := range []string{
		"桌面收纳盒",
		"最高总预算",
		"/api/v1/assets/00000000-0000-4000-8000-000000000009/content",
		"取消任务",
		"确认取消任务",
	} {
		if !strings.Contains(detail.Body.String(), value) {
			t.Fatalf("detail missing %q", value)
		}
	}

	form := url.Values{
		"csrf_token": {cookie.Value},
		"cancel_key": {cancelKey},
	}
	request := httptest.NewRequest(
		http.MethodPost,
		"/tasks/"+testTaskID+"/cancel",
		strings.NewReader(form.Encode()),
	)
	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	request.AddCookie(cookie)
	response := httptest.NewRecorder()
	router.ServeHTTP(response, request)

	if response.Code != http.StatusSeeOther ||
		response.Header().Get("Location") !=
			"/tasks/"+testTaskID+"?notice=canceled" {
		t.Fatalf(
			"status/location = %d/%q",
			response.Code,
			response.Header().Get("Location"),
		)
	}
	if service.cancelInput.TaskID != testTaskID ||
		service.cancelInput.IdempotencyKey != cancelKey {
		t.Fatalf("cancel input = %+v", service.cancelInput)
	}
}

func TestTaskDetailDoesNotLeakForbiddenResource(t *testing.T) {
	service := &fakeService{getErr: ErrForbidden}
	router := newTestRouter(t, service)
	response := performRequest(
		t,
		router,
		http.MethodGet,
		"/tasks/"+testTaskID,
		nil,
		"",
	)

	if response.Code != http.StatusNotFound {
		t.Fatalf("status = %d", response.Code)
	}
	if !strings.Contains(response.Body.String(), "不存在或当前不可访问") {
		t.Fatalf("safe not-found message missing: %s", response.Body)
	}
}

func TestTaskDetailCancelModeFollowsLifecycleStatus(t *testing.T) {
	tests := []struct {
		status      string
		canCancel   bool
		requiresAck bool
	}{
		{status: "PENDING", canCancel: true},
		{status: "CLAIMED", canCancel: true},
		{status: "RUNNING", canCancel: true, requiresAck: true},
		{
			status:      "WAITING_CONFIRMATION",
			canCancel:   true,
			requiresAck: true,
		},
		{status: "SUCCEEDED"},
		{status: "FAILED"},
		{status: "CANCELED"},
	}
	for _, test := range tests {
		t.Run(test.status, func(t *testing.T) {
			view := taskDetailViewFrom(Task{Status: test.status})
			if view.CanCancel != test.canCancel ||
				view.CancelRequiresAck != test.requiresAck {
				t.Fatalf("task detail view = %+v", view)
			}
		})
	}
	if notice := detailNotice("cancel-requested"); !strings.Contains(
		notice,
		"安全停止",
	) {
		t.Fatalf("cancel requested notice = %q", notice)
	}
}

func TestRunningTaskDetailExplainsCancelAcknowledgement(t *testing.T) {
	service := &fakeService{
		getResult: Task{
			ID:               testTaskID,
			Title:            "运行中任务",
			SKU:              "RUNNING-SKU",
			Quantity:         1,
			Status:           "RUNNING",
			ReferenceAssetID: "00000000-0000-4000-8000-000000000009",
			CreatedAt:        time.Now().UTC(),
			UpdatedAt:        time.Now().UTC(),
		},
	}
	router := newTestRouter(t, service)
	response := performRequest(
		t,
		router,
		http.MethodGet,
		"/tasks/"+testTaskID,
		nil,
		"",
	)
	if response.Code != http.StatusOK {
		t.Fatalf("running task detail status = %d", response.Code)
	}
	body := response.Body.String()
	for _, expected := range []string{
		"请求安全停止任务？",
		"设备确认前任务仍保持当前执行状态",
		"确认请求停止",
	} {
		if !strings.Contains(body, expected) {
			t.Fatalf("running detail missing %q", expected)
		}
	}
	if strings.Contains(body, "采购执行员将不能再领取") {
		t.Fatal("running detail uses immediate cancellation copy")
	}
}

func TestStaticFilesAreEmbeddedAndProtected(t *testing.T) {
	router := newTestRouter(t, &fakeService{})
	for _, route := range []string{"/static/admin.css", "/static/admin.js"} {
		response := performRequest(
			t,
			router,
			http.MethodGet,
			route,
			nil,
			"",
		)
		if response.Code != http.StatusOK || response.Body.Len() == 0 {
			t.Fatalf("%s status/bytes = %d/%d", route, response.Code, response.Body.Len())
		}
		assertSecurityHeaders(t, response)
	}
}

func TestRendererUsesMissingKeyErrors(t *testing.T) {
	renderer, err := NewRenderer()
	if err != nil {
		t.Fatalf("NewRenderer() error = %v", err)
	}
	var output bytes.Buffer
	if err := renderer.Execute(&output, "tasks", struct{}{}); err == nil {
		t.Fatal("Execute() with incomplete data error = nil")
	}
}

type fakeService struct {
	listInput    ListTasksInput
	listResult   TaskList
	listErr      error
	getResult    Task
	getErr       error
	uploadResult UploadedAsset
	uploadErr    error
	uploadInput  UploadReferenceInput
	uploadBody   []byte
	uploadCalls  int
	createResult Task
	createErr    error
	createInput  CreateTaskInput
	createCalls  int
	cancelResult Task
	cancelErr    error
	cancelInput  CancelTaskInput
}

func (service *fakeService) ListTasks(
	_ context.Context,
	input ListTasksInput,
) (TaskList, error) {
	service.listInput = input
	return service.listResult, service.listErr
}

func (service *fakeService) GetTask(
	context.Context,
	string,
) (Task, error) {
	return service.getResult, service.getErr
}

func (service *fakeService) UploadReference(
	_ context.Context,
	input UploadReferenceInput,
) (UploadedAsset, error) {
	service.uploadCalls++
	service.uploadInput = input
	content, err := io.ReadAll(input.Content)
	if err != nil {
		return UploadedAsset{}, err
	}
	service.uploadBody = content
	return service.uploadResult, service.uploadErr
}

func (service *fakeService) CreateTask(
	_ context.Context,
	input CreateTaskInput,
) (Task, error) {
	service.createCalls++
	service.createInput = input
	return service.createResult, service.createErr
}

func (service *fakeService) CancelTask(
	_ context.Context,
	input CancelTaskInput,
) (Task, error) {
	service.cancelInput = input
	return service.cancelResult, service.cancelErr
}

func newTestRouter(t *testing.T, service Service) http.Handler {
	t.Helper()
	gin.SetMode(gin.TestMode)
	renderer, err := NewRenderer()
	if err != nil {
		t.Fatalf("NewRenderer() error = %v", err)
	}
	handler, err := NewHandler(service, renderer)
	if err != nil {
		t.Fatalf("NewHandler() error = %v", err)
	}
	router := gin.New()
	handler.Register(router)
	return router
}

func performRequest(
	t *testing.T,
	handler http.Handler,
	method string,
	path string,
	body io.Reader,
	contentType string,
) *httptest.ResponseRecorder {
	t.Helper()
	request := httptest.NewRequest(method, path, body)
	if contentType != "" {
		request.Header.Set("Content-Type", contentType)
	}
	response := httptest.NewRecorder()
	handler.ServeHTTP(response, request)
	return response
}

func getCSRFCookie(t *testing.T, handler http.Handler) *http.Cookie {
	t.Helper()
	response := performRequest(
		t,
		handler,
		http.MethodGet,
		"/tasks/new",
		nil,
		"",
	)
	return csrfCookie(t, response)
}

func csrfCookie(
	t *testing.T,
	response *httptest.ResponseRecorder,
) *http.Cookie {
	t.Helper()
	for _, cookie := range response.Result().Cookies() {
		if cookie.Name == csrfCookieName &&
			cookie.Path == "/" &&
			cookie.Value != "" {
			return cookie
		}
	}
	t.Fatal("CSRF cookie not found")
	return nil
}

func multipartBody(
	t *testing.T,
	fields map[string]string,
	fileField string,
	fileName string,
	content []byte,
) (*bytes.Buffer, string) {
	t.Helper()
	var body bytes.Buffer
	writer := multipart.NewWriter(&body)
	for name, value := range fields {
		if err := writer.WriteField(name, value); err != nil {
			t.Fatalf("WriteField(%s): %v", name, err)
		}
	}
	if fileField != "" {
		part, err := writer.CreateFormFile(fileField, fileName)
		if err != nil {
			t.Fatalf("CreateFormFile(): %v", err)
		}
		if _, err := part.Write(content); err != nil {
			t.Fatalf("write file: %v", err)
		}
	}
	if err := writer.Close(); err != nil {
		t.Fatalf("close multipart: %v", err)
	}
	return &body, writer.FormDataContentType()
}

func validCreateBody(
	t *testing.T,
	csrfToken string,
	overrides map[string]string,
) (*bytes.Buffer, string) {
	t.Helper()
	fields := map[string]string{
		"csrf_token":  csrfToken,
		"title":       "桌面收纳盒",
		"sku":         "SKU-1",
		"description": "浅灰色",
		"quantity":    "2",
		"max_budget":  "60.00",
		"upload_key":  mustToken(t),
		"create_key":  mustToken(t),
	}
	for name, value := range overrides {
		fields[name] = value
	}
	fileField := "image"
	fileName := "reference.jpg"
	content := []byte("image bytes")
	if fields["image_asset_id"] != "" {
		fileField = ""
		fileName = ""
		content = nil
	}
	return multipartBody(t, fields, fileField, fileName, content)
}

func mustToken(t *testing.T) string {
	t.Helper()
	token, err := newToken()
	if err != nil {
		t.Fatalf("newToken() error = %v", err)
	}
	return token
}

func hiddenValue(t *testing.T, body string, name string) string {
	t.Helper()
	pattern := regexp.MustCompile(
		`name="` + regexp.QuoteMeta(name) + `" value="([^"]+)"`,
	)
	match := pattern.FindStringSubmatch(body)
	if len(match) != 2 {
		t.Fatalf("hidden field %q not found", name)
	}
	return match[1]
}

func assertSecurityHeaders(
	t *testing.T,
	response *httptest.ResponseRecorder,
) {
	t.Helper()
	required := map[string]string{
		"Cache-Control":          "no-store",
		"Referrer-Policy":        "no-referrer",
		"X-Content-Type-Options": "nosniff",
		"X-Frame-Options":        "DENY",
	}
	for name, want := range required {
		if got := response.Header().Get(name); got != want {
			t.Fatalf("%s = %q, want %q", name, got, want)
		}
	}
	csp := response.Header().Get("Content-Security-Policy")
	for _, directive := range []string{
		"default-src 'none'",
		"form-action 'self'",
		"frame-ancestors 'none'",
		"script-src 'self'",
		"style-src 'self'",
	} {
		if !strings.Contains(csp, directive) {
			t.Fatalf("CSP missing %q: %s", directive, csp)
		}
	}
}

func TestUsecaseErrorMappingKeepsPublicSentinels(t *testing.T) {
	tests := []struct {
		kind usecase.ErrorKind
		code string
		want error
	}{
		{
			kind: usecase.ErrorKindInvalid,
			code: "ASSET_IMAGE_INVALID",
			want: ErrInvalidFile,
		},
		{
			kind: usecase.ErrorKindInvalid,
			code: "TASK_VALIDATION_FAILED",
			want: ErrValidation,
		},
		{
			kind: usecase.ErrorKindInvalid,
			code: "TASK_CANCEL_INVALID",
			want: ErrNotFound,
		},
		{
			kind: usecase.ErrorKindNotFound,
			code: "TASK_NOT_FOUND",
			want: ErrNotFound,
		},
		{
			kind: usecase.ErrorKindConflict,
			code: "TASK_STATE_CONFLICT",
			want: ErrConflict,
		},
		{
			kind: usecase.ErrorKindUnavailable,
			code: "STORAGE_UNAVAILABLE",
			want: ErrUnavailable,
		},
	}
	for _, test := range tests {
		t.Run(test.code, func(t *testing.T) {
			mapped := mapUsecaseError(&usecase.Error{
				Kind: test.kind,
				Code: test.code,
			})
			if !errors.Is(mapped, test.want) {
				t.Fatalf("mapped error = %v, want %v", mapped, test.want)
			}
		})
	}
}