catcrafts.net/tests/ShouldValidateForms/main.cpp

/*
catcrafts.net
Copyright (C) 2026 Catcrafts

The source code of this website is made available for viewing purposes only.
No permission is granted to copy, modify, distribute, or create derivative works.
*/

// The form layer: urlencoded parsing, the email/country shape checks, and
// checkout validation — the gate every order submission passes through.

import std;
import Catcrafts.Shared;

using namespace Catcrafts;

namespace {

int failures = 0;

void Check(bool ok, std::string_view what, std::string_view got = {}) {
    if (ok) return;
    ++failures;
    std::println(std::cerr, "FAIL: {}{}{}", what,
                 got.empty() ? "" : "  got: ", got);
}

} // namespace

int main() {
    using namespace Catcrafts::Form;

    // ── urlencoded parsing ────────────────────────────────────────────
    auto parse = [](std::string_view b) { return ParseUrlEncoded(b); };

    auto f = parse("email=a%40b.example&country=NL");
    Check(f.has_value(), "form: basic body parses");
    if (f) {
        Check(f->Get("email") == "a@b.example", "form: %40 decodes to @");
        Check(f->Get("country") == "NL", "form: second field");
        Check(f->Get("missing").empty(), "form: absent field is empty");
        Check(!f->Has("missing"), "form: Has() distinguishes absent");
    }
    Check(parse("a=1&&b=2")->Size() == 2, "form: empty segment tolerated");
    Check(parse("a=1&")->Size() == 1, "form: trailing & tolerated");
    Check(parse("flag")->Has("flag"), "form: valueless key present");
    Check(parse("")->Size() == 0, "form: empty body");
    Check(parse("q=hello+world")->Get("q") == "hello world", "form: + is space");
    Check(parse("q=a%2Bb")->Get("q") == "a+b", "form: %2B is a literal plus");
    Check(parse("n=caf%C3%A9")->Get("n") == "café", "form: utf-8 percent-decoding");
    Check(parse("n=100%")->Get("n") == "100%", "form: malformed escape passes through");
    Check(parse("n=%zz")->Get("n") == "%zz", "form: non-hex escape passes through");
    // A field name is not allowed to be empty — "=x" is malformed, not a field.
    Check(!parse("=x").has_value(), "form: empty field name rejected");
    // Oversized input must be refused outright rather than truncated: acting on
    // half a form is worse than refusing it.
    Check(!parse(std::string(kMaxBodyBytes + 1, 'a')).has_value(), "form: oversized body rejected");
    Check(!parse("a=" + std::string(kMaxFieldBytes + 1, 'x')).has_value(), "form: oversized field rejected");

    // ── email shape ───────────────────────────────────────────────────
    Check(LooksLikeEmail("a@b.example"), "email: minimal");
    Check(LooksLikeEmail("first.last+tag@sub.domain.example"), "email: tagged, subdomain");
    Check(!LooksLikeEmail("no-at-sign"), "email: no @");
    Check(!LooksLikeEmail("@domain.example"), "email: empty local part");
    Check(!LooksLikeEmail("user@"), "email: empty domain");
    Check(!LooksLikeEmail("a@b@c.example"), "email: two @");
    Check(!LooksLikeEmail("user@dotless"), "email: dotless domain");
    Check(!LooksLikeEmail("user@.example"), "email: domain starts with dot");
    Check(!LooksLikeEmail("a b@c.example"), "email: embedded space");
    // Header-injection characters must never survive into anything that later
    // builds an email envelope.
    Check(!LooksLikeEmail("a@b.example\nBcc: x@y.example"), "email: newline rejected");
    Check(!LooksLikeEmail("a@b.example\r\nSubject: x"), "email: CRLF rejected");
    Check(!LooksLikeEmail("a,b@c.example"), "email: comma rejected");
    Check(!LooksLikeEmail("<a@b.example>"), "email: angle brackets rejected");
    Check(!LooksLikeEmail(std::string(250, 'a') + "@b.example"), "email: over 254 chars rejected");

    // ── country code ──────────────────────────────────────────────────
    Check(LooksLikeCountryCode("NL"), "country: uppercase");
    Check(LooksLikeCountryCode("ca"), "country: lowercase accepted");
    Check(!LooksLikeCountryCode("NLD"), "country: three letters rejected");
    Check(!LooksLikeCountryCode("N"), "country: one letter rejected");
    Check(!LooksLikeCountryCode("N1"), "country: digit rejected");
    Check(!LooksLikeCountryCode(""), "country: empty rejected");
    Check(Upper("nl") == "NL", "country: normalised to upper");

    // ── trimming ──────────────────────────────────────────────────────
    Check(Trim("  x  ") == "x", "trim: spaces");
    Check(Trim("\t\r\nx\n") == "x", "trim: tabs and newlines");
    Check(Trim("   ").empty(), "trim: all whitespace");

    // ── checkout validation ───────────────────────────────────────────
    constexpr std::string_view kGoodOrder =
        "email=a%40b.example&name=Ada&street=Main%20St%201&postal=1234AB&city=Delft&country=nl";

    auto validate = [](std::string_view body) {
        return ValidateCheckout(*ParseUrlEncoded(body));
    };

    auto good = validate(kGoodOrder);
    Check(good.Ok(), "checkout: valid submission accepted");
    Check(good.value.country == "NL", "checkout: country uppercased");
    Check(good.value.street == "Main St 1", "checkout: street decoded and kept");

    Check(!validate("name=Ada&street=x&postal=1&city=y&country=NL").Ok(),
          "checkout: missing email rejected");
    Check(!validate("email=a%40b.example&street=x&postal=1&city=y&country=NL").Ok(),
          "checkout: missing name rejected");
    Check(!validate("email=a%40b.example&name=Ada&postal=1&city=y&country=NL").Ok(),
          "checkout: missing street rejected");
    Check(!validate("email=a%40b.example&name=Ada&street=x&city=y&country=NL").Ok(),
          "checkout: missing postal rejected");
    Check(!validate("email=a%40b.example&name=Ada&street=x&postal=1&country=NL").Ok(),
          "checkout: missing city rejected");
    Check(!validate("email=a%40b.example&name=Ada&street=x&postal=1&city=y").Ok(),
          "checkout: missing country rejected");
    Check(!validate("email=nonsense&name=Ada&street=x&postal=1&city=y&country=NL").Ok(),
          "checkout: bad email rejected");

    // Every problem is reported at once — a form that surfaces one error per
    // submission makes people resubmit to discover the rest.
    Check(validate("email=&name=&street=&postal=&city=&country=").errors.size() == 6,
          "checkout: errors accumulate");

    // Honeypot: a filled hidden field means a bot. The message must not name
    // the trap, or it teaches the next one how to pass.
    auto pot = validate(std::string(kGoodOrder) + "&website=http%3A%2F%2Fspam");
    Check(!pot.Ok(), "checkout: honeypot rejects");
    Check(pot.errors.size() == 1 && pot.errors[0].message.find("honeypot") == std::string::npos
          && pot.errors[0].message.find("website") == std::string::npos,
          "checkout: honeypot failure does not name the trap");

    Check(!validate("email=a%40b.example&name=" + std::string(200, 'x')
                    + "&street=x&postal=1&city=y&country=NL").Ok(),
          "checkout: overlong name rejected");

    // Colour and quantity: shape checks here, catalogue checks in the handler.
    Check(validate(std::string(kGoodOrder) + "&color=green&quantity=2").Ok(),
          "checkout: colour and quantity accepted");
    Check(validate(std::string(kGoodOrder) + "&quantity=2").value.quantity == 2,
          "checkout: quantity parsed");
    Check(validate(kGoodOrder).value.quantity == 1, "checkout: quantity defaults to 1");
    Check(!validate(std::string(kGoodOrder) + "&quantity=0").Ok(),
          "checkout: zero quantity rejected");
    Check(validate(std::string(kGoodOrder) + "&quantity=9").Ok(),
          "checkout: bulk quantity welcome");
    Check(validate(std::string(kGoodOrder) + "&quantity=99").Ok(),
          "checkout: the technical ceiling itself is fine");
    Check(!validate(std::string(kGoodOrder) + "&quantity=100").Ok(),
          "checkout: past the technical ceiling rejected");
    Check(!validate(std::string(kGoodOrder) + "&quantity=two").Ok(),
          "checkout: non-numeric quantity rejected");
    Check(!validate(std::string(kGoodOrder) + "&color=" + std::string(40, 'x')).Ok(),
          "checkout: oversized colour rejected");

    // The payment choice. Absent is a form that offered none (one rail
    // configured, or the no-JS fallback page) and the handler resolves it to
    // bank — the validator's job is only to refuse a word it does not know
    // rather than let it fall through to a default the buyer never picked.
    Check(validate(kGoodOrder).value.payChoice.empty(),
          "checkout: absent payment choice stays empty");
    Check(validate(std::string(kGoodOrder) + "&pay=bank").value.payChoice
              == Catcrafts::Form::kPayBank,
          "checkout: bank choice parsed");
    Check(validate(std::string(kGoodOrder) + "&pay=crypto").value.payChoice
              == Catcrafts::Form::kPayCrypto,
          "checkout: crypto choice parsed");
    {
        auto bogus = validate(std::string(kGoodOrder) + "&pay=free");
        Check(!bogus.Ok(), "checkout: unknown payment choice rejected");
        Check(bogus.errors.size() == 1 && bogus.errors[0].field == "pay",
              "checkout: the payment refusal hangs off the payment field");
    }

    // Destinations the shop refuses. Well-formed, real country codes — the
    // refusal is policy, so it has to survive every spelling the form accepts,
    // and it must not spill onto other non-EU destinations.
    auto withCountry = [&](std::string_view cc) {
        return validate("email=a%40b.example&name=Ada&street=x&postal=1&city=y&country="
                        + std::string(cc));
    };
    Check(!withCountry("US").Ok(), "checkout: US refused");
    Check(!withCountry("CA").Ok(), "checkout: CA refused");
    Check(!withCountry("us").Ok(), "checkout: lowercase US refused too");
    Check(withCountry("GB").Ok(), "checkout: other non-EU destinations still sell");
    Check(withCountry("NL").Ok(), "checkout: EU unaffected");
    {
        auto us = withCountry("US");
        Check(us.errors.size() == 1 && us.errors[0].field == "country",
              "checkout: refusal is a country error, nothing else");
        Check(us.errors[0].message == Catcrafts::Form::kNoSaleMessage,
              "checkout: refusal says where the shop does not sell");
        Check(us.value.country == "US", "checkout: refused country echoed back");
    }

    // The shipping refusals. These are templates rather than plain strings
    // because the buy page fills the same ones client-side, so the substitution
    // has to work on both {cc} and {n} — a template that silently kept its
    // placeholder would ship "up to {n} per order" to a real buyer.
    {
        const std::string none = NoShippingMessage("BR");
        Check(none.find("BR") != std::string::npos
                  && none.find("{cc}") == std::string::npos,
              "shipping copy: the uncovered-country message names the country");
        const std::string heavy = TooHeavyMessage("JP", 3);
        Check(heavy.find("JP") != std::string::npos && heavy.find("3") != std::string::npos
                  && heavy.find("{n}") == std::string::npos,
              "shipping copy: the too-heavy message names the country and the limit");
        const std::string nofit = TooHeavyMessage("JP", 0);
        Check(nofit.find("JP") != std::string::npos
                  && nofit.find("up to") == std::string::npos,
              "shipping copy: with nothing fitting it does not promise a quantity");
        Check(FillShipMessage("{cc} {n} {cc}", "NL", 2) == "NL 2 NL",
              "shipping copy: every placeholder is filled, not just the first");
        // Both messages must offer the way out, since the shop is refusing
        // business it would otherwise take.
        Check(none.find("orders@catcrafts.net") != std::string::npos
                  && heavy.find("orders@catcrafts.net") != std::string::npos
                  && nofit.find("orders@catcrafts.net") != std::string::npos,
              "shipping copy: every refusal names a human to email");
    }

    // A rejected field must still come back, or the visitor has to retype the
    // one thing they got wrong — the fastest way to lose a submission.
    auto rejected = validate("email=notanemail&name=Ada&street=Main%201&postal=1&city=y&country=NLD");
    Check(!rejected.Ok(), "checkout: invalid pair rejected");
    Check(rejected.value.email == "notanemail", "checkout: invalid email echoed back");
    Check(rejected.value.country == "NLD", "checkout: invalid country echoed back as typed");
    Check(rejected.value.name == "Ada", "checkout: valid sibling field preserved");

    if (failures != 0) {
        std::println(std::cerr, "{} check(s) failed", failures);
        return 1;
    }
    return 0;
}