"""V8.32 regression: authenticated inline preview stays same-origin and other routes stay denied."""
from test_factory_v2 import factory,site


def test_theme_preview_is_frameable_only_on_same_origin(factory):
    for theme in ('automotive','industrial','corporate','minimal'):
        for page in ('home','listing','product','article','about','contact'):
            result=factory.get(f'/api/factory/themes/{theme}/preview',params={'page_type':page})
            assert result.status_code==200,(theme,page,result.text[:120])
            assert result.headers['x-frame-options']=='SAMEORIGIN'
            assert result.headers['content-security-policy']=="frame-ancestors 'self'"
            assert result.headers['cache-control']=='no-store'
            assert 'text/html' in result.headers['content-type']
    assert factory.get('/theme-gallery').headers['x-frame-options']=='DENY'
    assert factory.get('/operations').headers['x-frame-options']=='DENY'
    assert factory.get('/api/factory/themes/automotive/preview.css').headers['x-frame-options']=='DENY'


def test_preview_requires_login_and_other_protections_remain(factory):
    from tests.legacy import LegacyTestClient as Client
    from app.main import app
    with Client(app) as unauth:
        result=unauth.get('/api/factory/themes/automotive/preview')
        assert result.status_code==401
    assert factory.get('/api/factory/themes/automotive/preview?page_type=invalid').status_code==400


def test_gallery_and_studio_show_useful_fallback_and_easy_buttons(factory):
    gallery=factory.get('/theme-gallery').text
    assert 'previewStatus' in gallery and 'retryPreview' in gallery and 'openPreview' in gallery
    assert 'requestedTheme' in gallery and 'response.ok' in gallery
    sid=site(factory)
    pages=factory.get(f'/api/sites/{sid}/entries').json()
    entry=pages[0]['id']
    html=factory.get(f'/editor/{sid}/{entry}').text
    assert 'studioAdvancedButton' in html
    assert 'sfNextAction' in html and 'sfCloseInspector' in html
    assert 'sandbox="allow-scripts"' in html and 'allow-same-origin' not in html
    js=factory.get('/ui/editor.js').text
    assert 'toggleAdvanced(){' in js
    assert "response.ok" in js and 'themePreviewSeq' in js
    assert '从图片素材库选择' in js and '上传新图片' in js
    css=factory.get('/ui/editor.css').text
    assert 'body:not(.sf-advanced-mode) #tabStyle' in css
    workspace=factory.get('/ui/workspace.js').text
    assert '预览页面效果' in workspace and '/theme-gallery?theme=' in workspace