//! The pages carry no inline code (oxygenhub#227), so the
//! Content-Security-Policy's `script-src 'self'` can be enforced: no
//! `<script>` without `src` (JSON data blocks aside) and no `on…=` handler
//! attributes in any template. Scripts belong in assets/ (hub.js reads
//! `data-confirm`, `data-autosubmit`, `data-select`).

#[test]
fn templates_carry_no_inline_scripts_or_handlers() {
    let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../templates");
    let handler = |s: &str| {
        s.match_indices(" on").any(|(i, _)| {
            let rest = &s[i + 3..];
            let name: String = rest.chars().take_while(|c| c.is_ascii_lowercase()).collect();
            !name.is_empty() && rest[name.len()..].starts_with("=\"")
        })
    };
    let mut found = Vec::new();
    for e in std::fs::read_dir(&dir).unwrap() {
        let path = e.unwrap().path();
        if path.extension().and_then(|x| x.to_str()) != Some("html") {
            continue;
        }
        let text = std::fs::read_to_string(&path).unwrap();
        for (n, line) in text.lines().enumerate() {
            let inline_script = line.match_indices("<script").any(|(i, _)| {
                let tag = &line[i..line[i..].find('>').map_or(line.len(), |e| i + e)];
                !tag.contains("src=") && !tag.contains("application/json")
            });
            if inline_script || handler(line) {
                found.push(format!("{}:{}: {}", path.file_name().unwrap().to_string_lossy(), n + 1, line.trim()));
            }
        }
    }
    assert!(found.is_empty(), "inline code the CSP would block:\n{}", found.join("\n"));
}