//! The pages carry no inline code (oxygenhub#227), so the

//! Content-Security-Policy's `script-src 'self'` can be enforced: no

//! `<script>` without `src` (JSON data blocks aside) and no `on…=` handler

//! attributes in any template. Scripts belong in assets/ (hub.js reads

//! `data-confirm`, `data-autosubmit`, `data-select`).

#[test]

fn templates_carry_no_inline_scripts_or_handlers() {

    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../templates");

    let handler = |s: &str| {

        s.match_indices(" on").any(|(i, _)| {

            let rest = &s[i + 3..];

            let name: String = rest.chars().take_while(|c| c.is_ascii_lowercase()).collect();

            !name.is_empty() && rest[name.len()..].starts_with("=\"")

        })

    };

    let mut found = Vec::new();

    for e in std::fs::read_dir(&dir).unwrap() {

        let path = e.unwrap().path();

        if path.extension().and_then(|x| x.to_str()) != Some("html") {

            continue;

        }

        let text = std::fs::read_to_string(&path).unwrap();

        for (n, line) in text.lines().enumerate() {

            let inline_script = line.match_indices("<script").any(|(i, _)| {

                let tag = &line[i..line[i..].find('>').map_or(line.len(), |e| i + e)];

                !tag.contains("src=") && !tag.contains("application/json")

            });

            if inline_script || handler(line) {

                found.push(format!("{}:{}: {}", path.file_name().unwrap().to_string_lossy(), n + 1, line.trim()));

            }

        }

    }

    assert!(found.is_empty(), "inline code the CSP would block:\n{}", found.join("\n"));

}