import test from 'node:test'; import assert from 'node:assert/strict'; import { normalizePreferences, safeWebUrl, wazeUrl } from '../ui/applications.js'; import { embedUrl } from '../ui/embeds.js'; test('launcher preferences migrate defaults and reject duplicate/unknown/hidden favorites', () => { assert.deepEqual(normalizePreferences(null).favorites,['home','drive','map','music']); const p=normalizePreferences({favorites:['youtube-music','youtube-music','invalid','spotify','home'],hidden:['spotify','invalid'],modes:{youtube:'same',spotify:'invalid'}}); assert.deepEqual(p.favorites,['youtube-music',null,null,null]); assert.deepEqual(p.hidden,['spotify']); assert.equal(p.modes.youtube,'same'); assert.equal(p.modes.spotify,'new'); assert.deepEqual(normalizePreferences({favorites:[]}).favorites,[null,null,null,null]); }); test('official embed URLs reject foreign origins and unsupported content',()=>{ assert.equal(embedUrl('spotify','https://open.spotify.com/playlist/abc123'),'https://open.spotify.com/embed/playlist/abc123'); assert.equal(embedUrl('spotify','https://open.spotify.com/'),''); assert.equal(embedUrl('spotify','https://evil.example/playlist/abc123'),''); assert.equal(embedUrl('youtube-music','https://music.youtube.com/watch?v=M7lc1UVf-VE'),'https://www.youtube.com/embed/M7lc1UVf-VE'); assert.equal(embedUrl('youtube-music','https://music.youtube.com/'),''); assert.equal(embedUrl('stream','javascript:alert(1)'),''); assert.equal(normalizePreferences({modes:{spotify:'embed',waze:'embed'}}).modes.spotify,'embed'); assert.equal(normalizePreferences({modes:{waze:'embed'}}).modes.waze,'new'); }); test('external links only allow web URLs and valid Waze destination coordinates', () => { for (const value of ['javascript:alert(1)','file:///x','https://name:pass@example.org','bad']) assert.equal(safeWebUrl(value),''); assert.equal(safeWebUrl('https://media.cunatbrule.fr/web/'),'https://media.cunatbrule.fr/web/'); const url = new URL(wazeUrl({lat:48.85,lon:2.35})); assert.equal(url.searchParams.get('ll'),'48.85,2.35'); assert.equal(url.searchParams.get('navigate'),'yes'); assert.equal(new URL(wazeUrl({lat:NaN,lon:0})).searchParams.has('ll'),false); });