verifiable-okf/packages/visualizer/test/render.test.ts at 97a49320e49f77d1720e21f103ea850f8ae8123e · lemmaoracle/verifiable-okf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
import { describe, it, expect } from "vitest";
import { fileURLToPath } from "node:url";
import { renderReport } from "../src/render.js";
import { visualize } from "../src/visualize.js";

const fixtures = fileURLToPath(new URL("../../../fixtures", import.meta.url));
const NOW = new Date("2026-06-15T00:00:00Z");

describe("renderReport (offline, self-contained)", () => {
  const html = renderReport([
    { id: "a.md", result: { status: "verified", reasons: [], issuer: "did:key:z6Mk" }, contentHash: "sha256:" + "a".repeat(64) },
    { id: "b.md", result: { status: "failed", reasons: ["integrity_mismatch"] } },
    { id: "c.md", result: { status: "unverified", reasons: [] } },
  ]);

  it("is a complete HTML document with all three badges", () => {
    expect(html).toMatch(/^<!doctype html>/i);
    expect(html).toContain(">verified<");
    expect(html).toContain(">failed<");
    expect(html).toContain(">unverified<");
    expect(html).toContain("integrity_mismatch");
  });

  it("references no external resources (no CDN, fully offline)", () => {
    // no remote stylesheet/script/image references
    expect(html).not.toMatch(/(?:src|href)\s*=\s*["']https?:\/\//i);
    expect(html).not.toMatch(/\/\/(?:cdn|unpkg|jsdelivr|fonts\.googleapis)/i);
  });

  it("makes no network calls and posts no data (no fetch / XHR / form)", () => {
    expect(html).not.toMatch(/fetch\(|XMLHttpRequest|navigator\.sendBeacon|<form/i);
  });

  it("escapes content to avoid HTML injection", () => {
    const out = renderReport([{ id: "<script>x</script>", result: { status: "failed", reasons: [] } }]);
    expect(out).toContain("&lt;script&gt;");
    expect(out).not.toContain("<script>x</script>");
  });
});

describe("visualize (verify a bundle → report)", () => {
  it("verifies the fixtures tree and reflects statuses in the report", async () => {
    const { items, html } = await visualize(fixtures, { now: NOW });
    expect(items.length).toBeGreaterThanOrEqual(5);
    const byId = Object.fromEntries(items.map((i) => [i.id, i.result.status]));
    expect(byId["signed/ga4-event.md"]).toBe("verified");
    expect(byId["unsigned/ga4-event.md"]).toBe("unverified");
    expect(byId["tampered/body-modified.md"]).toBe("failed");
    expect(html).toContain("signed/ga4-event.md");
  });
});