Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions app/console/admin_ui.py
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,9 @@ def _fmt_meta_detail(m: object, a: str) -> Markup:
payload = json.dumps(val, sort_keys=True, default=str)
blocks.append(
Markup(
'<div><strong>{}</strong></div>'
'<json-viewer data="{}" expanded="1" show-toolbar="true"></json-viewer>'
"<div><strong>{}</strong></div>"
'<andypf-json-viewer data="{}" expanded="1" show-copy="true">'
"</andypf-json-viewer>"
).format(label, payload)
)
else:
Expand Down
22 changes: 21 additions & 1 deletion tests/test_admin_ui.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
import base64
import os
import re
from pathlib import Path

import pytest
from fastapi import FastAPI
Expand Down Expand Up @@ -95,13 +97,31 @@ class Row:
# Dict values become a collapsible json-viewer component fed escaped JSON.
assert isinstance(rendered, Markup)
assert "/console/static/json_viewer.js" in rendered
assert "<json-viewer data=" in rendered
assert "<andypf-json-viewer data=" in rendered
assert "Generation Snapshot" in rendered
assert "&#34;provider&#34;: &#34;bedrock&#34;" in rendered
# Scalar values stay as plain labelled lines.
assert "Moderation Score:</strong> 0.42" in rendered


def test_meta_formatter_tag_matches_vendored_custom_element() -> None:
"""The emitted tag must be the one the vendored bundle registers — an
unknown tag silently renders as an empty element (prod regression)."""
bundle = (
Path(__file__).parent.parent / "app" / "console" / "static" / "json_viewer.js"
).read_text()
match = re.search(r'customElements\.define\("([^"]+)"', bundle)
assert match, "vendored bundle no longer registers a custom element?"
tag = match.group(1)

class Row:
meta = {"texet_generation": {"query": "hi"}}

rendered = _fmt_meta_detail(Row(), "meta")
assert f"<{tag} " in rendered
assert f"</{tag}>" in rendered


def test_meta_formatter_escapes_user_content() -> None:
class Row:
meta = {"texet_generation": {"query": '<script>alert("xss")</script>'}}
Expand Down
Loading