"""Responses carry the baseline headers, and uploads carry the strict ones.

The application image route is PUBLIC and one accepted image type is an XML
document that can carry a script. Loaded through an <img> tag that script never
runs, so the tiles were never the risk; opening the file's own URL is. These
tests pin the headers that make that case inert, because the failure is silent -
nothing about the page looks different when they are missing.
"""

import io

import pytest

from shopdb.utils.uploads import UPLOAD_CSP


def test_every_response_carries_the_baseline_headers(client):
    resp = client.get('/api/health')
    assert resp.headers.get('X-Content-Type-Options') == 'nosniff'
    assert resp.headers.get('X-Frame-Options') == 'SAMEORIGIN'
    assert resp.headers.get('Referrer-Policy') == 'strict-origin-when-cross-origin'


def test_an_error_response_carries_them_too(client):
    """after_request runs for error handlers as well, which is where a response
    built by a different code path would otherwise slip through."""
    resp = client.get('/api/no-such-route')
    assert resp.status_code == 404
    assert resp.headers.get('X-Content-Type-Options') == 'nosniff'


def test_a_served_upload_is_sandboxed(client, app, tmp_path):
    """The uploaded file itself gets a policy that blocks script execution."""
    from shopdb.core.api.applications import _appimage_dir

    with app.app_context():
        directory = _appimage_dir()
    svg = ('<svg xmlns="http://www.w3.org/2000/svg">'
           '<script>window.top.location="http://evil"</script></svg>')
    path = directory / 'probe-headers.svg' if hasattr(directory, '__truediv__') \
        else None
    if path is None:
        import os
        path = os.path.join(directory, 'probe-headers.svg')
        with open(path, 'w') as handle:
            handle.write(svg)
    else:
        path.write_text(svg)

    try:
        resp = client.get('/api/applications/image/probe-headers.svg')
        assert resp.status_code == 200
        assert resp.headers.get('Content-Security-Policy') == UPLOAD_CSP
        assert resp.headers.get('X-Content-Type-Options') == 'nosniff'
    finally:
        import os
        os.remove(path)
