website/client/test/teamForum.test.js

// What the Team forum's client half decides for itself (client/src/lib/teamForum.js).
//
// The point of this file is how LITTLE that is. Who may post, who may moderate,
// whether an image renders and whether a post may be edited are all server
// answers the panel reads. What is tested here is the three places the client
// turns those answers into what a reader sees — and one property that is easy to
// break by accident: the edit offer can only ever be withdrawn here, never
// granted.
import { test } from 'node:test'
import assert from 'node:assert/strict'

import { REPORT_REASONS, editOfferOpen, stripToText, threadSummary } from '../src/lib/teamForum.js'

const NOW = new Date('2026-08-18T12:00:00Z').getTime()
const inMinutes = (n) => new Date(NOW + n * 60_000).toISOString()

// ── the edit offer ─────────────────────────────────────────────────────────

test('the client can withdraw an edit offer and can never create one', () => {
  // The server said no. Nothing about a deadline changes that — a future
  // `editableUntil` on a post the server refused must not become an offer, or
  // the client would be granting a permission.
  assert.equal(editOfferOpen({ canEdit: false, editableUntil: inMinutes(10) }, NOW), false)
  assert.equal(editOfferOpen({ canEdit: false, editableUntil: null }, NOW), false)
})

test('a deadline that has passed while the page sat open withdraws the offer', () => {
  assert.equal(editOfferOpen({ canEdit: true, editableUntil: inMinutes(5) }, NOW), true)
  // Same post, fifteen minutes of the reader staring at it later.
  assert.equal(editOfferOpen({ canEdit: true, editableUntil: inMinutes(5) }, NOW + 15 * 60_000), false)
})

test('no deadline means no deadline, not no permission', () => {
  // Staff are not time-bounded, and `editableUntil: null` is how the server says
  // so. Reading it as "expired" would take the edit control away from exactly the
  // people whose authority does not expire.
  assert.equal(editOfferOpen({ canEdit: true, editableUntil: null }, NOW), true)
})

test('an unparseable deadline closes the offer rather than opening it', () => {
  assert.equal(editOfferOpen({ canEdit: true, editableUntil: 'not a date' }, NOW), false)
  assert.equal(editOfferOpen(null, NOW), false)
  assert.equal(editOfferOpen(undefined, NOW), false)
})

// ── round-tripping a body back into the composer ───────────────────────────

test('the image core generated is stripped, and the URL that made it survives', () => {
  // §5.5.3: the author wrote a URL, core emitted the <img> at read time. Handing
  // the <img> back would let an author edit markup they never wrote — and the
  // URL is what re-renders it, so nothing is lost by removing it.
  const rendered = '<p><a href="https://x/a.png" rel="noopener noreferrer">https://x/a.png</a>'
    + '<img src="https://x/a.png" class="forum-embed" referrerpolicy="no-referrer" /></p>'
  const text = stripToText(rendered)
  assert.ok(!text.includes('<img'))
  assert.ok(text.includes('https://x/a.png'))
})

test('paragraphs become blank lines and breaks become newlines', () => {
  assert.equal(stripToText('<p>One</p><p>Two</p>'), 'One\n\nTwo')
  assert.equal(stripToText('<p>One<br>Two</p>'), 'One\nTwo')
  // A paragraph carrying attributes is still a paragraph.
  assert.equal(stripToText('<p>One</p>\n<p class="x">Two</p>'), 'One\n\nTwo')
})

test('entities decode to what the author typed, and only once', () => {
  assert.equal(stripToText('<p>Tom &amp; Jerry</p>'), 'Tom & Jerry')
  assert.equal(stripToText('<p>&quot;quoted&quot;</p>'), '"quoted"')

  // The one that bites: an author who typed a literal "<script>" has it stored
  // escaped. Decoding entities BEFORE stripping tags would turn it into a real
  // tag that the strip pass then deletes — silently losing text the author wrote
  // and which was never dangerous.
  assert.equal(stripToText('<p>&lt;script&gt;</p>'), '<script>')
  // And decoding &amp; first would turn "&amp;lt;" into "<" in two steps.
  assert.equal(stripToText('<p>&amp;lt;</p>'), '&lt;')
})

test('an empty or absent body is an empty string, never a crash', () => {
  assert.equal(stripToText(''), '')
  assert.equal(stripToText(null), '')
  assert.equal(stripToText(undefined), '')
  assert.equal(stripToText('<p></p>'), '')
})

// ── the thread list line ───────────────────────────────────────────────────

test('a discussion counts REPLIES, which is one fewer than its posts', () => {
  // postCount includes the opening post. Showing it raw would tell a reader a
  // brand-new thread already has one reply.
  assert.equal(threadSummary({ type: 'discussion', author: 'ada', postCount: 1 }), 'ada')
  assert.equal(threadSummary({ type: 'discussion', author: 'ada', postCount: 2 }), 'ada · 1 reply')
  assert.equal(threadSummary({ type: 'discussion', author: 'ada', postCount: 4 }), 'ada · 3 replies')
})

test('an announcement says so and never counts replies, because it takes none', () => {
  const line = threadSummary({ type: 'announcement', author: 'aldric', postCount: 1 })
  assert.equal(line, 'Announcement · aldric')
  assert.ok(!line.includes('repl'))
})

test('hidden is said out loud — it is only shown to whoever can unhide it', () => {
  assert.equal(
    threadSummary({ type: 'discussion', author: 'ada', postCount: 1, status: 'hidden' }),
    'ada · hidden',
  )
})

// ── the report control ─────────────────────────────────────────────────────

test('every reason the server accepts is offered, and no others', () => {
  // The server validates against its own list; a client offering a reason the
  // server rejects produces a 400 the reporter cannot act on, and one MISSING a
  // reason quietly funnels those reports into "other".
  assert.deepEqual(
    REPORT_REASONS.map(([value]) => value).sort(),
    ['abuse', 'illegal', 'impersonation', 'other', 'sexual', 'spam'],
  )
  assert.ok(REPORT_REASONS.every(([, label]) => typeof label === 'string' && label.length > 0))
})