habitable/tests/test_htmlpacket.py at main · ghzhost/habitable · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
# SPDX-License-Identifier: AGPL-3.0-or-later
# Copyright 2026 Chelsea Kelly-Reif
"""The accessible HTML packet: structure + a real axe-core scan."""

from __future__ import annotations

import copy
import json
from collections.abc import Callable
from pathlib import Path

import pytest

from habitable.capture import capture
from habitable.htmlpacket import render_packet_html
from habitable.packet import build_packet
from habitable.tsa import LocalRfc3161TSA
from habitable.vault import Vault


def _packet(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    tsa: LocalRfc3161TSA,
    out: Path,
) -> Path:
    vault = make_vault()
    issue = vault.document.add_issue(category="mold", room="bath", title="Mold", issue_id="i1")
    vault.document.add_timeline_entry(issue, "observed", "spreading")
    capture(vault, make_jpeg(with_location=True), issue_id=issue, tsa=tsa)
    result = build_packet(vault, out, generated_at="2026-01-02T00:10:00Z")
    assert result.html_path is not None and result.html_path.is_file()
    return result.html_path


def test_html_packet_is_structurally_accessible(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    html = _packet(make_vault, make_jpeg, local_tsa, tmp_path / "pkt").read_text(encoding="utf-8")
    assert html.startswith("<!doctype html>")
    assert 'lang="en"' in html
    assert html.count("<h1>") == 1
    assert '<main id="main">' in html
    assert '<a class="skip" href="#main">' in html
    assert 'scope="col"' in html  # appendix table has header scopes
    assert "<caption>" in html
    # Images carry meaningful alt text (not empty).
    assert 'alt="Evidence photo' in html
    # No unescaped angle brackets from data (template/user content escaped).
    assert "<script" not in html.lower()


def test_html_packet_escapes_user_content(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    vault = make_vault()
    issue = vault.document.add_issue(
        category="mold", title="<img src=x onerror=alert(1)>", issue_id="i1"
    )
    capture(vault, make_jpeg(), issue_id=issue, tsa=local_tsa)
    result = build_packet(vault, tmp_path / "pkt", generated_at="2026-01-02T00:10:00Z")
    assert result.html_path is not None
    html = result.html_path.read_text(encoding="utf-8")
    assert "<img src=x onerror=alert(1)>" not in html  # escaped
    assert "&lt;img src=x onerror=alert(1)&gt;" in html


def test_byteless_item_renders_a_visible_warning_not_an_empty_figure(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    """issue #158 decision 3: ``build_packet`` now refuses to ever produce a
    byteless item (see tests/test_media_types.py), so this state can only
    reach ``render_packet_html`` via a hand-crafted or otherwise
    non-conformant bundle -- exactly the defense-in-depth scenario the visible
    rendering exists for (a packet from an older/different tool, or a future
    code path that bypasses ``build_packet``). Simulate that by mutating an
    otherwise-real, freshly built bundle's one item down to no bytes at all.
    """
    vault = make_vault()
    issue = vault.document.add_issue(category="mold", title="Mold", issue_id="i1")
    capture(vault, make_jpeg(with_location=True), issue_id=issue, tsa=local_tsa)
    out = tmp_path / "pkt"
    build_packet(vault, out, generated_at="2026-01-02T00:10:00Z", make_pdf=False)

    bundle = json.loads((out / "bundle.json").read_text(encoding="utf-8"))
    bundle["items"][0]["shared_name"] = ""
    bundle["items"][0]["shared_hash"] = ""
    bundle["items"][0]["has_original"] = False

    rendered = tmp_path / "byteless.html"
    render_packet_html(bundle, out / "media", rendered)
    html = rendered.read_text(encoding="utf-8")

    assert (
        "No photo, recording, or file was included for this item. Its content hash "
        "and timestamp exist, but there are no evidence bytes here to view or "
        "verify." in html
    )
    assert '<img src="media/' not in html  # never a silently empty figure
    assert "NONE — no evidence bytes" in html  # the appendix table says so too


def test_original_only_item_renders_a_visible_notice_with_a_download_link(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    """An item with an embedded original but no shared preview copy (e.g. a
    HEIC capture exported with ``--include-originals``, see
    tests/test_media_types.py) is a deliberate, disclosed, higher-disclosure
    choice, not a defect -- it must be visibly explained, not rendered as an
    empty figure either."""
    vault = make_vault()
    issue = vault.document.add_issue(category="mold", title="Mold", issue_id="i1")
    capture(vault, make_jpeg(with_location=True), issue_id=issue, tsa=local_tsa)
    out = tmp_path / "pkt"
    build_packet(
        vault, out, generated_at="2026-01-02T00:10:00Z", make_pdf=False, include_originals=True
    )

    bundle = json.loads((out / "bundle.json").read_text(encoding="utf-8"))
    original_item = copy.deepcopy(bundle["items"][0])
    original_item["shared_name"] = ""
    original_item["shared_hash"] = ""
    assert original_item["has_original"] is True
    bundle["items"][0] = original_item

    rendered = tmp_path / "original-only.html"
    render_packet_html(bundle, out / "media", rendered)
    html = rendered.read_text(encoding="utf-8")

    capture_id = original_item["capture_id"]
    assert "No shared preview copy was made for this item" in html
    assert "sealed original file is embedded and hash-verified" in html
    assert f'<a href="originals/{capture_id}">download the original</a>' in html
    assert "may retain full metadata, including location" in html
    assert '<img src="media/' not in html
    assert "original only (no shared preview)" in html  # the appendix table too


def _inspector(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    tsa: LocalRfc3161TSA,
    out: Path,
) -> Path:
    vault = make_vault()
    issue = vault.document.add_issue(category="mold", room="bath", title="Mold", issue_id="i1")
    vault.document.add_timeline_entry(issue, "observed", "spreading")
    capture(vault, make_jpeg(with_location=True), issue_id=issue, tsa=tsa)
    result = build_packet(vault, out, generated_at="2026-01-02T00:10:00Z", inspector_view=True)
    assert result.inspector_path is not None and result.inspector_path.is_file()
    assert result.inspector_path.name == "inspector.html"
    # packet.html is unchanged / still produced alongside the derived view.
    assert result.html_path is not None and result.html_path.is_file()
    return result.inspector_path


def test_inspector_view_is_structurally_accessible(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    html = _inspector(make_vault, make_jpeg, local_tsa, tmp_path / "pkt").read_text(
        encoding="utf-8"
    )
    assert html.startswith("<!doctype html>")
    assert 'lang="en"' in html
    assert html.count("<h1>") == 1
    assert '<main id="main">' in html
    assert '<a class="skip" href="#main">' in html
    # Nested room -> condition headings: the room is an h2 that precedes its h3.
    assert '<h2 id="room-0">Room: bath</h2>' in html
    assert "<h3>Condition: mold</h3>" in html
    assert html.index("Room: bath") < html.index("Condition: mold")
    # The evidence appendix (with header scopes) is reused.
    assert 'scope="col"' in html
    assert "<caption>" in html
    assert "<script" not in html.lower()


def test_inspector_view_groups_and_orders_timeline(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    html = _inspector(make_vault, make_jpeg, local_tsa, tmp_path / "pkt").read_text(
        encoding="utf-8"
    )
    # The room heading precedes the condition, which precedes the issue timeline.
    room_pos = html.index("Room: bath")
    note_pos = html.index("spreading")
    capture_pos = html.index("Evidence captured")
    assert room_pos < note_pos
    # The timeline note (00:00:00Z) is chronologically before the capture (03:04:05Z).
    assert note_pos < capture_pos
    # Both a timeline note and a capture event appear in the merged timeline.
    assert "observed:" in html
    assert "timestamp token attached; authority trust not assessed" in html


def test_inspector_view_escapes_user_content(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    vault = make_vault()
    issue = vault.document.add_issue(
        category="mold", room="<b>bath</b>", title="<img src=x onerror=alert(1)>", issue_id="i1"
    )
    vault.document.add_timeline_entry(issue, "observed", "<script>evil()</script>")
    capture(vault, make_jpeg(), issue_id=issue, tsa=local_tsa)
    result = build_packet(
        vault, tmp_path / "pkt", generated_at="2026-01-02T00:10:00Z", inspector_view=True
    )
    assert result.inspector_path is not None
    html = result.inspector_path.read_text(encoding="utf-8")
    assert "<img src=x onerror=alert(1)>" not in html
    assert "&lt;img src=x onerror=alert(1)&gt;" in html
    assert "<b>bath</b>" not in html
    assert "&lt;b&gt;bath&lt;/b&gt;" in html
    assert "<script>evil()</script>" not in html
    assert "&lt;script&gt;evil()&lt;/script&gt;" in html


@pytest.mark.a11y
def test_html_packet_passes_axe(
    make_vault: Callable[..., Vault],
    make_jpeg: Callable[..., Path],
    local_tsa: LocalRfc3161TSA,
    tmp_path: Path,
) -> None:
    pytest.importorskip("playwright.sync_api")
    pytest.importorskip("axe_playwright_python.sync_playwright")
    from axe_playwright_python.sync_playwright import Axe
    from playwright.sync_api import Error as PlaywrightError
    from playwright.sync_api import sync_playwright

    html_path = _packet(make_vault, make_jpeg, local_tsa, tmp_path / "pkt")
    with sync_playwright() as p:
        try:
            browser = p.chromium.launch()
        except PlaywrightError as exc:
            pytest.skip(f"Chromium not available: {exc}")
        try:
            page = browser.new_page()
            page.goto(html_path.as_uri(), wait_until="load")
            results = Axe().run(page)
        finally:
            browser.close()
    blocking = [
        v
        for v in results.response.get("violations", [])
        if v.get("impact") in {"moderate", "serious", "critical"}
    ]
    assert not blocking, [v["id"] for v in blocking]