([^<]+)

#!/usr/bin/env python3 """Deterministic structural tests for the committed desfoto.de build in site/. Run after `python3 scripts/build-site.py`: python3 -m unittest discover -s tests -v The tests only read generated files, so they are fast and side-effect free. """ from __future__ import annotations import json import re import sys import unittest from html import unescape from pathlib import Path ROOT = Path(__file__).resolve().parents[1] SITE = ROOT / "site" SRC = ROOT / "src" sys.path.insert(0, str(SRC)) import pages # noqa: E402 from content import CONTACT, LEGAL, SITE as META # noqa: E402 ROUTE_PATHS = [route[0] for route in pages.ROUTES] HTML_FILES = sorted(SITE.rglob("*.html")) def read(path: Path) -> str: return path.read_text(encoding="utf-8") def visible_text(html_text: str) -> str: body = re.search(r"", html_text, re.S) chunk = body.group(0) if body else html_text chunk = re.sub(r"<(script|style)\b.*?", " ", chunk, flags=re.S) return unescape(re.sub(r"\s+", " ", re.sub(r"<[^>]+>", " ", chunk))).strip() class BuildLayout(unittest.TestCase): def test_every_route_is_built(self): for route in pages.ROUTES: _path, rel = route[0], route[1] with self.subTest(route=route[0]): self.assertTrue((SITE / rel).is_file(), f"missing {rel}") def test_no_stray_html_files(self): expected = {route[1] for route in pages.ROUTES} | {"404.html"} actual = {str(f.relative_to(SITE)) for f in HTML_FILES} self.assertEqual(expected, actual) def test_site_files_are_world_readable(self): """The nginx worker is not root: 0600 build output would 403 in production.""" for path in SITE.rglob("*"): if path.is_dir(): continue with self.subTest(asset=str(path.relative_to(SITE))): self.assertTrue(path.stat().st_mode & 0o044, f"{path} is not world readable") def test_meta_files_exist(self): for rel in ( "sitemap.xml", "robots.txt", "site.webmanifest", "favicon.svg", ".well-known/security.txt", "assets/site.css", "assets/site.js", "assets/fonts.css", ): with self.subTest(rel=rel): self.assertTrue((SITE / rel).is_file(), f"missing {rel}") class HeadTags(unittest.TestCase): def test_titles_descriptions_and_canonicals(self): for path in ROUTE_PATHS: rel = dict((r[0], r[1]) for r in pages.ROUTES)[path] with self.subTest(route=path): text = read(SITE / rel) self.assertIn('', text) title = re.search(r"([^<]+)", text) self.assertIsNotNone(title) self.assertTrue(title.group(1).strip()) desc = re.search(r'', text) self.assertIn('', text) self.assertNotIn('rel="canonical"', text) def test_single_h1_per_page(self): for path in ROUTE_PATHS: rel = dict((r[0], r[1]) for r in pages.ROUTES)[path] with self.subTest(route=path): self.assertEqual(read(SITE / rel).count("(.*?)', read(SITE / rel), re.S, ): with self.subTest(route=path): json.loads(block) class ImagesAndAssets(unittest.TestCase): def test_every_img_has_alt(self): for file in HTML_FILES: for tag in re.findall(r"]*>", read(file)): with self.subTest(file=file.name): self.assertIn('alt="', tag) def test_wordpress_style_external_assets_absent(self): """No privacy page promise may be broken: nothing is loaded cross-origin.""" allowed = {"https://www.youtube-nocookie.com"} for file in HTML_FILES + [SITE / "assets" / "site.css", SITE / "assets" / "fonts.css"]: text = read(file) candidates = list(re.findall(r'(?:src|srcset|imagesrcset|poster)="([^"]+)"', text)) candidates += list(re.findall(r"url$([^)]*)$", text)) for match in candidates: for url in re.findall(r"(https?://[^\s,)'\"]+)", match): with self.subTest(file=file.name, url=url): self.assertIn(url.split("/embed")[0], allowed | {META["url"]}) def test_referenced_images_exist(self): for file in HTML_FILES: text = read(file) for candidate in set(re.findall(r"/assets/img/([A-Za-z0-9._-]+)", text)): with self.subTest(file=file.name, asset=candidate): self.assertTrue((SITE / "assets" / "img" / candidate).is_file()) def test_no_hero_image_without_dimensions(self): for file in HTML_FILES: for tag in re.findall(r"]*>", read(file)): with self.subTest(file=file.name): self.assertIn("width=", tag) self.assertIn("height=", tag) class PrivacyAndLegal(unittest.TestCase): def test_no_cookies_analytics_or_third_party_scripts(self): for file in HTML_FILES: text = read(file).lower() with self.subTest(file=file.name): for forbidden in ("google-analytics", "googletagmanager", "gtag(", "document.cookie", "fonts.googleapis"): self.assertNotIn(forbidden, text) def test_nginx_writes_no_access_log(self): conf = read(ROOT / "nginx.conf") self.assertIn("access_log off;", conf) self.assertIn("error_log /dev/null crit;", conf) self.assertNotIn("/var/log/nginx", conf) def test_nginx_sets_the_documented_security_headers(self): conf = read(ROOT / "nginx.conf") for header in ( "X-Content-Type-Options", "Referrer-Policy", "X-Frame-Options", "Permissions-Policy", "Strict-Transport-Security", "Content-Security-Policy", ): with self.subTest(header=header): self.assertIn(f"add_header {header}", conf) self.assertIn("default-src 'self'", conf) self.assertIn("frame-src https://www.youtube-nocookie.com", conf) self.assertIn("form-action 'self' mailto:", conf) def test_styles_and_scripts_revalidate(self): """site.css/site.js are not content-hashed: they must be revalidated.""" conf = read(ROOT / "nginx.conf") cache_rule = re.search(r'~\^/assets/site\\\.$css\|js$\$\s+"([^"]+)"', conf) self.assertIsNotNone(cache_rule) self.assertIn("max-age=0", cache_rule.group(1)) self.assertIn("must-revalidate", cache_rule.group(1)) def test_index_html_redirect_handles_query_strings(self): conf = read(ROOT / "nginx.conf") self.assertIn(r"^/(.*/)?index\.html(\?.*)?$", conf) def test_impressum_has_required_provider_data(self): text = visible_text(read(SITE / "impressum" / "index.html")) for value in ( LEGAL["owner"], LEGAL["street"], LEGAL["city"], CONTACT["email"], CONTACT["phone"], "§ 5 DDG", "§ 19 UStG", LEGAL["w_id"], "§ 18 Abs. 2 MStV", ): with self.subTest(value=value): self.assertIn(value, text) def test_datenschutz_covers_the_actual_data_flows(self): text = visible_text(read(SITE / "datenschutz" / "index.html")) for needle in ( "keine Zugriffsprotokolle", "keine Cookies", "youtube-nocookie.com", "Art. 6 Abs. 1 lit. f DSGVO", LEGAL["authority"], "Art. 22 DSGVO", ): with self.subTest(needle=needle): self.assertIn(needle, text) def test_datenschutz_matches_the_log_free_server_configuration(self): """The page must describe `error_log /dev/null`, not a retention period.""" text = visible_text(read(SITE / "datenschutz" / "index.html")) self.assertIn("Fehlerprotokoll wird nicht geschrieben", text) self.assertNotIn("14 Tagen gelöscht", text) conf = read(ROOT / "nginx.conf") self.assertIn("error_log /dev/null crit;", conf) def test_site_javascript_is_local_and_stateless(self): js = read(SITE / "assets" / "site.js") for forbidden in ( "document.cookie", "localStorage", "sessionStorage", "indexedDB", "navigator.sendBeacon", "XMLHttpRequest", "fetch(", "WebSocket", ): with self.subTest(forbidden=forbidden): self.assertNotIn(forbidden, js) def test_contact_form_sends_nothing_by_default(self): text = read(SITE / "kontakt" / "index.html") self.assertIn("data-contact-form", text) self.assertIn('action="mailto:info@dennyschulz.de"', text) self.assertNotIn('method="post" action="/', text) self.assertIn("sendet nichts an einen Server", visible_text(text)) def test_https_links_and_no_plain_http(self): for file in HTML_FILES: with self.subTest(file=file.name): self.assertNotIn("http://desfoto.de", read(file)) class Content(unittest.TestCase): def test_all_requested_services_are_reachable(self): home = read(SITE / "index.html") for href in ( "/businessfotografie/", "/familien-und-paare/", "/minishootings/", "/projekte/", "/video/", "/social-media/", ): with self.subTest(href=href): self.assertIn(f'href="{href}"', home) def test_pro_bono_work_is_offered(self): projekte = read(SITE / "projekte" / "index.html") self.assertIn("Pro bono", projekte) self.assertIn("Pro-bono-Anfrage senden", projekte) kontakt = read(SITE / "kontakt" / "index.html") self.assertIn("Pro-bono-Anfrage", kontakt) def test_music_video_is_embedded_and_only_after_a_click(self): text = read(SITE / "video" / "index.html") self.assertIn("NWWFTf7l8g0", text) self.assertIn("youtube-nocookie.com", read(SITE / "assets" / "site.js")) self.assertNotIn("youtube.com/embed", text) def test_no_placeholder_or_unfinished_text(self): markers = ("lorem ipsum", "todo", "tbd", "xxx", "platzhalter", "coming soon") for file in HTML_FILES: lower = read(file).lower() for marker in markers: with self.subTest(file=file.name, marker=marker): self.assertNotIn(marker, lower) def test_footer_on_every_page(self): for file in HTML_FILES: text = read(file) with self.subTest(file=file.name): self.assertIn('href="/impressum/"', text) self.assertIn('href="/datenschutz/"', text) self.assertIn(CONTACT["email"], text) def test_sitemap_matches_routes(self): sitemap = read(SITE / "sitemap.xml") for path in ROUTE_PATHS: with self.subTest(route=path): self.assertIn(f"{META['url']}{path}", sitemap) self.assertNotIn("404", sitemap) def test_robots_allows_crawling(self): self.assertIn("User-agent: *", read(SITE / "robots.txt")) self.assertIn(f"Sitemap: {META['url']}/sitemap.xml", read(SITE / "robots.txt")) class Release(unittest.TestCase): def test_deploy_removes_only_targeted_desfoto_labels(self): deploy = read(ROOT / ".ocauto" / "deploy") self.assertNotIn('"desfoto" not in line', deploy) self.assertNotIn("sudo python3", deploy) self.assertIn("traefik\\..*desfoto", deploy) self.assertIn("stack-backup", deploy) def test_deploy_validates_before_replacing_the_shared_stack(self): deploy = read(ROOT / ".ocauto" / "deploy") self.assertIn('config --quiet', deploy) self.assertIn('mktemp "$STACK_DIR/', deploy) self.assertIn('sudo mv "$stack_tmp" "$stack_file"', deploy) def test_deploy_hooks_are_executable(self): import os for name in ("qa", "deploy", "verify"): with self.subTest(hook=name): path = ROOT / ".ocauto" / name self.assertTrue(path.is_file(), f"missing .ocauto/{name}") self.assertTrue(os.access(path, os.X_OK), f".ocauto/{name} is not executable") class Fonts(unittest.TestCase): def test_fonts_are_self_hosted(self): css = read(SITE / "assets" / "fonts.css") self.assertIn("@font-face", css) self.assertIn("font-display:swap", css) urls = re.findall(r"url$'([^']+)'$", css) self.assertTrue(urls) for url in urls: with self.subTest(url=url): self.assertTrue(url.startswith("/assets/fonts/")) self.assertTrue((SITE / url.lstrip("/")).is_file()) def test_licences_shipped(self): for name in ("font-fraunces-OFL.txt", "font-manrope-OFL.txt"): with self.subTest(name=name): self.assertTrue((ROOT / "docs" / name).is_file()) if __name__ == "__main__": unittest.main(verbosity=2)