"""monitor tests — page renders, no sensitive data, escapes input."""

from __future__ import annotations

from cayceops.components.monitor import monitor
from cayceops.models import ContentItem, DaemonRun, MailMessage, Proposal


def _seed(sess):
    sess.add(DaemonRun(daemon="scanner", status="ok", detail={"proposed": 3}))
    sess.add(Proposal(kind="affiliate", title="Title with <script>alert(1)</script>"))
    sess.add(
        MailMessage(
            direction="in",
            from_addr="secret-person@private.example.org",
            subject="private subject",
            classification="approval",
            draft_status="drafted",
        )
    )
    sess.add(ContentItem(theme="atm-fees", channel="nostr", caption="caption", status="draft"))
    sess.flush()


def test_build_renders_all_sections(cfg, sess, tmp_path):
    _seed(sess)
    out = tmp_path / "status.html"
    monitor._build(cfg(CAYCE_OPS_MONITOR_OUTPUT=str(out)), sess)
    page = out.read_text()

    assert "daemon health" in page
    assert "proposal queue" in page
    assert "recent audit activity" in page
    assert "scanner" in page
    assert "proposed: <strong>1</strong>" in page
    assert "mail drafts awaiting approval: <strong>1</strong>" in page


def test_build_leaks_no_sensitive_data(cfg, sess, tmp_path):
    _seed(sess)
    out = tmp_path / "status.html"
    monitor._build(cfg(CAYCE_OPS_MONITOR_OUTPUT=str(out)), sess)
    page = out.read_text()

    assert "secret-person@private.example.org" not in page  # no addresses
    assert "private subject" not in page  # no subjects
    assert "caption" not in page  # no content bodies
    assert "Title with" not in page  # proposal titles not rendered


def test_build_escapes_injected_content(cfg, sess, tmp_path):
    from datetime import UTC, datetime

    from cayceops.models import AuditEntry

    sess.add(
        AuditEntry(
            ts=datetime.now(UTC),
            actor="<script>x</script>",
            action="probe",
            detail={},
        )
    )
    sess.flush()
    out = tmp_path / "status.html"
    monitor._build(cfg(CAYCE_OPS_MONITOR_OUTPUT=str(out)), sess)
    page = out.read_text()
    assert "<script>x</script>" not in page
    assert "&lt;script&gt;x&lt;/script&gt;" in page