"""Unit tests for the notification card markup helpers (PR 2026-05-02).

Covers:
* ``_apply_inline_markup`` — channel-aware [r] / [b] expansion
* ``_resolve_cta_line``    — Feishu drops, email keeps
* ``_collapse_blank_lines``— gap removal after empty cta_line
* ``_escape_card_markdown`` interaction — user input with `<>` is
  escaped BEFORE markup expansion so trusted ``<font>`` tags from
  ``[r]`` survive while raw ``<script>`` injected via context vars
  does not.
"""
from __future__ import annotations

import pytest

from app.notifications.service import (
    _apply_inline_markup,
    _collapse_blank_lines,
    _escape_card_markdown,
    _resolve_cta_line,
)

# ─── _apply_inline_markup ─────────────────────────────────────────


@pytest.mark.parametrize("channel,expected", [
    (
        "feishu_card",
        "Hello <font color='red'>**$1,234**</font> world **bold** here",
    ),
    (
        "email_text",
        "Hello **$1,234** world **bold** here",
    ),
    (
        "email_html",
        'Hello <strong style="color:#d4380d;">$1,234</strong> world '
        "<strong>bold</strong> here",
    ),
])
def test_apply_inline_markup_per_channel(channel, expected):
    out = _apply_inline_markup(
        "Hello [r]$1,234[/r] world [b]bold[/b] here", channel=channel,
    )
    assert out == expected


def test_apply_inline_markup_unknown_channel_falls_back_to_plain():
    out = _apply_inline_markup("[r]X[/r]", channel="garbage")
    # Default branch matches email_text — bold asterisks.
    assert out == "**X**"


def test_apply_inline_markup_no_markers_is_passthrough():
    src = "no markers here, just text"
    for channel in ("feishu_card", "email_text", "email_html"):
        assert _apply_inline_markup(src, channel=channel) == src


# ─── _resolve_cta_line ────────────────────────────────────────────


@pytest.mark.parametrize("channel,expected", [
    ("feishu_card", ""),  # button covers the CTA
    ("email_text", "请到 Helix 查看: https://helix.example.com/x"),
    ("email_html", "请到 Helix 查看: https://helix.example.com/x"),
])
def test_resolve_cta_line_per_channel_zh(channel, expected):
    out = _resolve_cta_line(
        channel=channel,
        portal_url="https://helix.example.com/x",
        lang="zh-CN",
    )
    assert out == expected


def test_resolve_cta_line_email_en():
    out = _resolve_cta_line(
        channel="email_text",
        portal_url="https://helix.example.com/x",
        lang="en_US",
    )
    assert out == "View in Helix: https://helix.example.com/x"


def test_resolve_cta_line_no_url_returns_empty_for_every_channel():
    for channel in ("feishu_card", "email_text", "email_html"):
        for lang in ("zh-CN", "en_US", None):
            assert _resolve_cta_line(
                channel=channel, portal_url=None, lang=lang,
            ) == ""


# ─── _collapse_blank_lines ────────────────────────────────────────


def test_collapse_blank_lines_keeps_single_blank():
    assert _collapse_blank_lines("a\n\nb") == "a\n\nb"


def test_collapse_blank_lines_squashes_multiple():
    # Templates that put `{cta_line}` between two blank lines end up
    # with three blanks when the placeholder is empty (Feishu).
    assert _collapse_blank_lines("a\n\n\n\n\nb") == "a\n\nb"


def test_collapse_blank_lines_preserves_trailing_blank():
    # Single trailing newline preserved (Feishu cards rely on it).
    assert _collapse_blank_lines("a\nb\n") == "a\nb\n"


# ─── escape × markup interaction ──────────────────────────────────


def test_user_supplied_angle_brackets_get_escaped_but_markup_survives():
    # Hostile context value (someone's display name with HTML).
    body = (
        "Hi <script>evil</script>, your overage is "
        "[r]$1,234[/r] this month."
    )
    escaped = _escape_card_markdown(body)
    # `<script>` tags are neutralised…
    assert "&lt;script&gt;" in escaped
    assert "<script>" not in escaped
    # …and the bracket markers survive escape unchanged so the
    # subsequent markup pass turns them into trusted Feishu HTML.
    assert "[r]$1,234[/r]" in escaped
    rendered = _apply_inline_markup(escaped, channel="feishu_card")
    assert "<font color='red'>**$1,234**</font>" in rendered
    # `<script>` stays escaped; only OUR <font> tag is unescaped HTML.
    assert "&lt;script&gt;" in rendered
    assert "<script>" not in rendered