"""Tests for the sfpermits.ai web UI."""
import pytest
import sys
import os
import web.app as _app_mod
from web.helpers import md_to_html, _rate_buckets
@pytest.fixture
def client():
_app = _app_mod.app # Always get the current app from the module
_app.config["TESTING"] = True
_rate_buckets.clear() # Reset rate limits between tests
with _app.test_client() as client:
yield client
_rate_buckets.clear()
def test_index_loads_landing_page(client):
"""Homepage renders landing page for unauthenticated users."""
rv = client.get("/")
assert rv.status_code == 200
html = rv.data.decode()
assert "sfpermits.ai" in html
assert "Building Permit Intelligence" in html
assert "/search" in html # search form action
def test_index_loads_app_when_logged_in(client):
"""Homepage renders full app for authenticated users."""
import src.db as db_mod
if db_mod.BACKEND == "duckdb":
db_mod.init_user_schema()
from web.auth import get_or_create_user, create_magic_token
user = get_or_create_user("indextest@test.com")
token = create_magic_token(user["user_id"])
client.get(f"/auth/verify/{token}", follow_redirects=True)
rv = client.get("/")
assert rv.status_code == 200
html = rv.data.decode()
assert "sfpermits.ai" in html
assert "Analyze Project" in html
assert "Kitchen Remodel" in html # preset chip
def test_index_has_neighborhoods(client):
"""Neighborhood dropdown is populated for authenticated users."""
import src.db as db_mod
if db_mod.BACKEND == "duckdb":
db_mod.init_user_schema()
from web.auth import get_or_create_user, create_magic_token
user = get_or_create_user("hoodtest@test.com")
token = create_magic_token(user["user_id"])
client.get(f"/auth/verify/{token}", follow_redirects=True)
rv = client.get("/")
html = rv.data.decode()
assert "Noe Valley" in html
assert "Mission" in html
assert "Pacific Heights" in html
def test_analyze_empty_description(client):
"""POST with empty description returns 400."""
rv = client.post("/analyze", data={"description": ""})
assert rv.status_code == 400
assert b"Please enter a project description" in rv.data
def test_analyze_basic(client):
"""POST with minimal input returns 5 result panels."""
rv = client.post("/analyze", data={
"description": "Kitchen remodel removing wall",
"cost": "85000",
"neighborhood": "Noe Valley",
})
assert rv.status_code == 200
html = rv.data.decode()
# All 5 tab panels present
assert 'id="panel-predict"' in html
assert 'id="panel-fees"' in html
assert 'id="panel-timeline"' in html
assert 'id="panel-docs"' in html
assert 'id="panel-risk"' in html
def test_analyze_no_cost(client):
"""POST without cost still runs predict/timeline/docs/risk but fees shows info message."""
rv = client.post("/analyze", data={
"description": "Small bathroom refresh",
})
assert rv.status_code == 200
html = rv.data.decode()
assert 'id="panel-predict"' in html
assert "Enter an estimated cost" in html # fees info message
def test_analyze_restaurant(client):
"""Restaurant project triggers DPH/fire routing."""
rv = client.post("/analyze", data={
"description": "Convert retail to restaurant with Type I hood, grease interceptor, 49 seats",
"cost": "250000",
"neighborhood": "Mission",
})
assert rv.status_code == 200
html = rv.data.decode()
assert "restaurant" in html.lower() or "food" in html.lower()
def test_analyze_adu(client):
"""ADU project gets proper routing."""
rv = client.post("/analyze", data={
"description": "Convert garage to ADU with kitchenette and bathroom, 450 sq ft",
"cost": "180000",
"sqft": "450",
"neighborhood": "Sunset/Parkside",
})
assert rv.status_code == 200
html = rv.data.decode()
assert "adu" in html.lower() or "accessory" in html.lower()
def test_md_to_html_basic():
"""md_to_html converts markdown tables and bold."""
result = md_to_html("**bold text**\n\n| A | B |\n|---|---|\n| 1 | 2 |")
assert "<strong>" in result
assert "<table>" in result
def test_md_to_html_links():
"""md_to_html preserves links."""
result = md_to_html("[sf.gov](https://sf.gov)")
assert 'href="https://sf.gov"' in result
# --- Plan Set Validator web tests ---
def _make_simple_pdf():
"""Create a minimal valid PDF for upload tests."""
from pypdf import PdfWriter
from pypdf.generic import RectangleObject
writer = PdfWriter()
writer.add_blank_page(width=22 * 72, height=34 * 72)
import io
buf = io.BytesIO()
writer.write(buf)
return buf.getvalue()
def test_index_has_validator(client):
"""Homepage includes the plan analysis (AI Vision) section for logged-in users."""
import src.db as db_mod
if db_mod.BACKEND == "duckdb":
db_mod.init_user_schema()
from web.auth import get_or_create_user, create_magic_token
user = get_or_create_user("validatortest@test.com")
token = create_magic_token(user["user_id"])
client.get(f"/auth/verify/{token}", follow_redirects=True)
rv = client.get("/")
html = rv.data.decode()
# Section was renamed from 'Plan Set Validator' to 'Analyze Plans (AI Vision)'
assert "Analyze Plans" in html or "analyze-plans" in html
assert "planfile" in html # file input
def test_validate_no_file(client):
"""POST to /validate with no file returns 400."""
rv = client.post("/validate", data={})
assert rv.status_code == 400
assert b"Please select a PDF" in rv.data
def test_validate_non_pdf(client):
"""POST to /validate with non-PDF returns 400."""
from io import BytesIO
rv = client.post("/validate", data={
"planfile": (BytesIO(b"not a pdf"), "readme.txt"),
}, content_type="multipart/form-data")
assert rv.status_code == 400
assert b"Only PDF files" in rv.data
def test_validate_empty_pdf(client):
"""POST to /validate with empty file returns 400."""
from io import BytesIO
rv = client.post("/validate", data={
"planfile": (BytesIO(b""), "plans.pdf"),
}, content_type="multipart/form-data")
assert rv.status_code == 400
assert b"empty" in rv.data
def test_validate_success(client):
"""POST to /validate with valid PDF returns EPR report."""
from io import BytesIO
pdf_data = _make_simple_pdf()
rv = client.post("/validate", data={
"planfile": (BytesIO(pdf_data), "A-PLAN-R0 123 Main St.pdf"),
}, content_type="multipart/form-data")
assert rv.status_code == 200
html = rv.data.decode()
assert "EPR Compliance Report" in html
assert "A-PLAN-R0 123 Main St.pdf" in html
def test_validate_with_addendum(client):
"""POST with addendum checkbox uses higher file limit."""
from io import BytesIO
pdf_data = _make_simple_pdf()
rv = client.post("/validate", data={
"planfile": (BytesIO(pdf_data), "plans.pdf"),
"is_addendum": "on",
}, content_type="multipart/form-data")
assert rv.status_code == 200
html = rv.data.decode()
assert "EPR Compliance Report" in html
# --- Security & bot protection tests ---
def test_robots_txt(client):
"""robots.txt blocks all crawlers during beta."""
rv = client.get("/robots.txt")
assert rv.status_code == 200
body = rv.data.decode()
assert "User-agent: *" in body
assert "Disallow: /" in body
assert rv.content_type.startswith("text/plain")
def test_blocked_scanner_paths(client):
"""Vulnerability scanner probe paths return 404."""
for path in ["/wp-admin", "/wp-login.php", "/.env", "/.git", "/phpmyadmin"]:
rv = client.get(path)
assert rv.status_code == 404, f"{path} should return 404"
def test_rate_limit_analyze(client):
"""Rate limit triggers after 10 /analyze POSTs in a window."""
_rate_buckets.clear()
for i in range(10):
rv = client.post("/analyze", data={"description": f"test project {i}"})
assert rv.status_code == 200
# 11th should be rate limited
rv = client.post("/analyze", data={"description": "one more"})
assert rv.status_code == 429
assert b"Rate limit" in rv.data
_rate_buckets.clear()
def test_rate_limit_validate(client):
"""Rate limit triggers after 5 /validate POSTs in a window."""
from io import BytesIO
_rate_buckets.clear()
pdf_data = _make_simple_pdf()
for i in range(5):
rv = client.post("/validate", data={
"planfile": (BytesIO(pdf_data), "plans.pdf"),
}, content_type="multipart/form-data")
assert rv.status_code == 200
# 6th should be rate limited
rv = client.post("/validate", data={
"planfile": (BytesIO(pdf_data), "plans.pdf"),
}, content_type="multipart/form-data")
assert rv.status_code == 429
_rate_buckets.clear()
def test_noindex_meta_tag(client):
"""Beta page has noindex meta tag for authenticated users."""
import src.db as db_mod
if db_mod.BACKEND == "duckdb":
db_mod.init_user_schema()
from web.auth import get_or_create_user, create_magic_token
user = get_or_create_user("noindextest@test.com")
token = create_magic_token(user["user_id"])
client.get(f"/auth/verify/{token}", follow_redirects=True)
rv = client.get("/")
html = rv.data.decode()
assert 'name="robots"' in html
assert "noindex" in html
# --- Enhanced Input Form tests ---
def test_index_has_personalization(client):
"""Homepage includes the collapsible personalization section for logged-in users."""
import src.db as db_mod
if db_mod.BACKEND == "duckdb":
db_mod.init_user_schema()
from web.auth import get_or_create_user, create_magic_token
user = get_or_create_user("personalizetest@test.com")
token = create_magic_token(user["user_id"])
client.get(f"/auth/verify/{token}", follow_redirects=True)
rv = client.get("/")
html = rv.data.decode()
assert "personalize-section" in html
assert "priority-chip" in html
assert "contractor_name" in html
assert "architect_name" in html
assert "consultant_name" in html
assert "experience_level" in html
assert "additional_context" in html
assert "target_date" in html
def test_analyze_with_priorities(client):
"""POST with priority chips reorders result tabs."""
rv = client.post("/analyze", data={
"description": "Kitchen remodel with budget concerns",
"cost": "85000",
"priorities": "cost,timeline",
})
assert rv.status_code == 200
html = rv.data.decode()
# Fees tab should appear (cost priority)
assert "panel-fees" in html
assert "panel-timeline" in html
def test_analyze_with_additional_context(client):
"""Additional context triggers are picked up."""
rv = client.post("/analyze", data={
"description": "Office renovation",
"cost": "200000",
"additional_context": "This is a historic landmark building with seismic concerns",
})
assert rv.status_code == 200
html = rv.data.decode()
# The enriched description should trigger historic and seismic pathways
assert "panel-predict" in html
def test_analyze_with_experience_level(client):
"""Experience level parameter is accepted."""
rv = client.post("/analyze", data={
"description": "Simple bathroom refresh",
"experience_level": "first_time",
})
assert rv.status_code == 200
def test_analyze_with_team_names_no_match(client):
"""Team names that don't match still return 200 with results."""
rv = client.post("/analyze", data={
"description": "Kitchen remodel in Noe Valley",
"cost": "85000",
"contractor_name": "Nonexistent Contractor XYZ12345",
})
assert rv.status_code == 200
html = rv.data.decode()
# Should have team tab since a name was provided
assert "panel-predict" in html
def test_analyze_with_target_date(client):
"""Target date parameter is accepted."""
rv = client.post("/analyze", data={
"description": "Kitchen remodel",
"cost": "85000",
"target_date": "2027-01-15",
})
assert rv.status_code == 200
html = rv.data.decode()
assert "panel-timeline" in html
# ---------------------------------------------------------------------------
# Report share: field name fix + personal message
# ---------------------------------------------------------------------------
def test_report_share_requires_login(client):
"""Report share endpoint requires authentication."""
rv = client.post("/report/0001/001/share", data={
"email": "friend@example.com",
})
# Should redirect to login or return 302/401
assert rv.status_code in (302, 401, 403)
def test_report_share_rejects_bad_email(client):
"""Report share rejects invalid email."""
# Login first (need auth helper from test_auth pattern)
import sys, os
sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(__file__)), "web"))
from web.auth import get_or_create_user, create_magic_token
# Force duckdb for this test
import src.db as db_mod
if db_mod.BACKEND == "duckdb":
db_mod.init_user_schema()
user = get_or_create_user("sharer@test.com")
token = create_magic_token(user["user_id"])
client.get(f"/auth/verify/{token}", follow_redirects=True)
rv = client.post("/report/0001/001/share", data={
"email": "notanemail",
})
assert rv.status_code == 400
assert b"valid email" in rv.data
def test_report_share_form_uses_correct_field_name():
"""Report share form sends field name 'email' matching the route."""
import os
template_path = os.path.join(
os.path.dirname(os.path.dirname(__file__)),
"web", "templates", "report.html"
)
with open(template_path) as f:
content = f.read()
# The form should use name="email" to match the route
assert 'name="email"' in content
# Should NOT use the old mismatched field name
assert 'name="recipient_email"' not in content
def test_report_share_form_has_message_field():
"""Report share form includes a personal message textarea."""
import os
template_path = os.path.join(
os.path.dirname(os.path.dirname(__file__)),
"web", "templates", "report.html"
)
with open(template_path) as f:
content = f.read()
assert 'name="message"' in content
assert "personal note" in content.lower()
def test_report_has_prominent_share_button():
"""Report page has a prominent share button in the report body (not just header)."""
import os
template_path = os.path.join(
os.path.dirname(os.path.dirname(__file__)),
"web", "templates", "report.html"
)
with open(template_path) as f:
content = f.read()
# Should have a share button that opens the share modal
assert "openShareModal()" in content
# The button should contain share text
assert "Share" in content
def test_report_email_template_supports_personal_message():
"""Report email template renders personal message block."""
from flask import Flask
test_app = Flask(__name__, template_folder=os.path.join(
os.path.dirname(os.path.dirname(__file__)), "web", "templates"
))
test_app.config["TESTING"] = True
# Mock ReportLinks
class MockLinks:
@staticmethod
def permit(n): return f"http://test/{n}"
@staticmethod
def complaint(n): return f"http://test/{n}"
@staticmethod
def parcel(b, l): return f"http://test/{b}/{l}"
@staticmethod
def planning_code(s): return f"http://test/{s}"
@staticmethod
def entity(n): return f"http://test/{n}"
@staticmethod
def ethics_registry(): return "http://test/ethics"
with test_app.app_context():
from flask import render_template
html = render_template(
"report_email.html",
report={
"address": "123 Test St",
"block": "0001",
"lot": "001",
"links": {"parcel": "http://test/parcel"},
},
report_url="http://test/report/0001/001",
is_owner=False,
links=MockLinks,
sender_name="Tim",
personal_message="Check out this property!",
)
assert "Tim" in html
assert "Check out this property!" in html
assert "shared this with you" in html
def test_report_email_template_hides_message_when_empty():
"""Report email template hides message block when no message."""
from flask import Flask
test_app = Flask(__name__, template_folder=os.path.join(
os.path.dirname(os.path.dirname(__file__)), "web", "templates"
))
test_app.config["TESTING"] = True
class MockLinks:
@staticmethod
def permit(n): return f"http://test/{n}"
@staticmethod
def complaint(n): return f"http://test/{n}"
@staticmethod
def parcel(b, l): return f"http://test/{b}/{l}"
@staticmethod
def planning_code(s): return f"http://test/{s}"
@staticmethod
def entity(n): return f"http://test/{n}"
@staticmethod
def ethics_registry(): return "http://test/ethics"
with test_app.app_context():
from flask import render_template
html = render_template(
"report_email.html",
report={
"address": "456 Other St",
"block": "0002",
"lot": "002",
"links": {"parcel": "http://test/parcel"},
},
report_url="http://test/report/0002/002",
is_owner=False,
links=MockLinks,
)
assert "shared this with you" not in html
