brain-of-reese/tests/e2e/test_document_back_navigation.py

"""Phase 13 E2E (Playwright): the viewer's back button returns to the
page the document was opened from.

Story: ``.agent/user_stories/document-back-navigation.md``
Run in isolation (DB must be up: ``podman compose up -d db``):

    uv run pytest tests/e2e/test_document_back_navigation.py -v --no-cov

Both entry points (chat source chips, Sources table links) open the viewer
in a NEW tab, where there is no browser history — so the return target is
carried in the viewer URL: chat chips append ``&back=%2F`` (resolves to
"Chat"), Sources links omit the param (the viewer's default
``/sources.html`` applies → "Sources"). The viewer only honors
same-origin relative ``back`` values; everything else falls back to
``/sources.html``.

Test → story mapping (Playwright Mapping Rule):
1. ``test_back_from_chat_returns_to_chat`` — question → source chip →
   new tab with ``&back=%2F`` → back link href ``/`` labeled "Chat" →
   click → the chat page.
2. ``test_back_from_sources_returns_to_sources`` — Sources table link →
   new tab without a ``back`` param → back link href ``/sources.html``
   labeled "Sources" → click → the Sources page.
3. ``test_malicious_back_param_is_rejected`` — absolute,
   protocol-relative, and ``javascript:`` ``back`` values all fall back
   to ``/sources.html`` (labeled "Sources", navigable).
"""
from __future__ import annotations

import asyncio
import re
from pathlib import Path
from threading import Thread
from typing import Any

from playwright.sync_api import Page, expect
from sqlalchemy import text

from app.config import Settings
from app.db import SessionLocal
from app.rag.importer import ImportSummary, import_sources
from app.rag.llm import LLMClient
from e2e.auth_helpers import login

REPO = Path(__file__).resolve().parents[2]
FIXTURES = REPO / "tests" / "fixtures" / "docs"
QUESTION = "How is my Kubernetes cluster set up?"
# Seeded fixture doc (source=docs) shared by every test in this file.
DOC_SOURCE = "docs"
DOC_PATH = "homelab%2Fkubernetes.md"
DOC_TITLE = "Kubernetes Homelab Cluster"


async def _import_fixtures(mock_port: int) -> ImportSummary:
    kwargs: dict[str, Any] = {"_env_file": None, "llm_base_url": f"http://127.0.0.1:{mock_port}/v1"}
    settings = Settings(**kwargs)  # pyright: ignore[reportCallIssue]
    return await import_sources([FIXTURES], LLMClient(settings))


def _run_in_thread(coro: Any) -> Any:
    """Run a coroutine on a worker thread.

    Playwright's sync API keeps an asyncio loop running on the test thread,
    so ``asyncio.run`` cannot be called directly from a test body.
    """
    box: dict[str, Any] = {}

    def runner() -> None:
        try:
            box["value"] = asyncio.run(coro)
        except BaseException as e:  # noqa: BLE001 — re-raised on the test thread
            box["error"] = e

    t = Thread(target=runner)
    t.start()
    t.join()
    if "error" in box:
        raise box["error"]
    return box["value"]


def _reset_db(mock_port: int, seed: bool) -> ImportSummary | None:
    """Truncate the KB (and query log), then optionally re-import fixtures."""
    with SessionLocal() as db:
        db.execute(text("TRUNCATE chunks, documents, query_log"))
        db.commit()
    if not seed:
        return None
    return _run_in_thread(_import_fixtures(mock_port))


# ---------------------------------------------------------------------------
# 1. Chat source chip → viewer with back=/ → back returns to the chat
# ---------------------------------------------------------------------------


def test_back_from_chat_returns_to_chat(
    page: Page, app_url: str, mock_llm: int, db_ready: None
) -> None:
    _reset_db(mock_llm, seed=True)
    page.set_default_timeout(30_000)
    page.goto(app_url)

    page.fill("#message-input", QUESTION)
    page.click("#send-btn")

    chip = page.locator(".msg.brain .source-chip", has_text="kubernetes.md")
    expect(chip).to_have_count(1, timeout=30_000)
    # Chat chips carry back=/ (encoded %2F) so the viewer knows where home is.
    expect(chip.first).to_have_attribute(
        "href", f"/document.html?source={DOC_SOURCE}&path={DOC_PATH}&back=%2F"
    )

    with page.expect_popup() as popup_info:
        chip.first.click()
    viewer = popup_info.value
    expect(viewer).to_have_url(
        re.compile(
            re.escape(f"{app_url}/document.html?source={DOC_SOURCE}&path={DOC_PATH}&back=%2F")
        )
    )
    # The cited document actually rendered (this is the viewer, not an error).
    expect(viewer.locator("#doc-title")).to_have_text(DOC_TITLE)
    # Back link resolved to the chat page, labeled "Chat".
    back = viewer.locator("#doc-back")
    expect(back).to_have_attribute("href", "/")
    expect(back).to_have_text("Chat")

    # Click: deterministic anchor navigation back to the chat page.
    back.click()
    expect(viewer).to_have_url(f"{app_url}/")
    expect(viewer.locator("#composer")).to_be_visible()


# ---------------------------------------------------------------------------
# 2. Sources table link → viewer without back param → back returns to Sources
# ---------------------------------------------------------------------------


def test_back_from_sources_returns_to_sources(
    page: Page, app_url: str, mock_llm: int, db_ready: None
) -> None:
    _reset_db(mock_llm, seed=True)
    login(page, app_url)  # phase 16: the Sources table is admin-only

    row = page.locator("#docs-tbody tr", has_text="kubernetes.md")
    expect(row).to_have_count(1)
    link = row.locator("td:nth-child(2) a.doc-link")
    expect(link).to_have_count(1)
    # Sources links carry NO back param — the viewer's default target
    # (/sources.html) applies.
    expect(link).to_have_attribute(
        "href", f"/document.html?source={DOC_SOURCE}&path={DOC_PATH}"
    )

    with page.expect_popup() as popup_info:
        link.click()
    viewer = popup_info.value
    assert "back=" not in viewer.url, f"unexpected back param: {viewer.url}"
    expect(viewer.locator("#doc-title")).to_have_text(DOC_TITLE)
    # Back link kept the default target, labeled "Sources".
    back = viewer.locator("#doc-back")
    expect(back).to_have_attribute("href", "/sources.html")
    expect(back).to_have_text("Sources")

    back.click()
    expect(viewer).to_have_url(f"{app_url}/sources.html")
    expect(viewer.locator("#docs-table")).to_be_visible()


# ---------------------------------------------------------------------------
# 3. Hostile back values (absolute, protocol-relative, pseudo-protocol)
#    are all rejected in favor of the same-origin default
# ---------------------------------------------------------------------------


def test_malicious_back_param_is_rejected(
    page: Page, app_url: str, mock_llm: int, db_ready: None
) -> None:
    _reset_db(mock_llm, seed=True)
    errors: list[str] = []
    dialogs: list[str] = []
    page.on("pageerror", lambda e: errors.append(str(e)))

    def _catch_dialog(d) -> None:  # a fired dialog == executed script
        dialogs.append(d.message)
        d.dismiss()

    page.on("dialog", _catch_dialog)

    viewer_base = f"{app_url}/document.html?source={DOC_SOURCE}&path={DOC_PATH}"
    # Anything that is not a same-origin relative URL must be rejected:
    # an absolute https URL, a protocol-relative URL, and a javascript:
    # pseudo-protocol.
    for evil in ("https%3A%2F%2Fevil.com", "%2F%2Fevil.com", "javascript%3Aalert(1)"):
        page.goto(f"{viewer_base}&back={evil}")
        expect(page.locator("#doc-title")).to_have_text(DOC_TITLE)
        back = page.locator("#doc-back")
        expect(back).to_have_attribute("href", "/sources.html")
        expect(back).to_have_text("Sources")

    # And the fallback is really navigable: clicking lands on Sources.
    page.click("#doc-back")
    expect(page).to_have_url(f"{app_url}/sources.html")

    assert dialogs == [], f"dialog fired — a back param escaped validation: {dialogs}"
    assert errors == [], f"console crashes: {errors}"