UI

membership/members/tests/test_service_groups.py

@@ -15,7 +15,7 @@ from django.utils import timezone
 
 from members import billing, views
 from members.models import Account, CryptoInvoice, ManagedGroup, Subscription
-from members.service_groups import configured_groups, validate_service_groups
+from members.service_groups import configured_groups, service_names, validate_service_groups
 from ldap3 import Connection, MOCK_SYNC, Server
 
 BASE = "ou=groups,dc=example,dc=org"
@@ -79,6 +79,42 @@ class ServiceGroupLDAPIntegrationTests(TestCase):
             self.assertTrue(ManagedGroup.objects.filter(account=member, dn=FREE_GROUP).exists())
 
 
+@override_settings(MEMBERSHIP_TIERS=TIERS)
+class ServiceDisplayTests(TestCase):
+    @override_settings(MEMBERSHIP_SERVICE_GROUPS={
+        "0": ["cn=Dex Users," + BASE, "cn=Matrix Users," + BASE],
+        "1": ["cn=Gitea Users," + BASE],
+        "2": ["cn=Mastodon Users," + BASE, "cn=PeerTube Users," + BASE],
+    })
+    def test_home_displays_exact_level_services_without_ldap_or_settings_mutation(self):
+        with patch("members.directory.connection", side_effect=AssertionError("Public page must not contact LDAP")):
+            response = self.client.get("/members/")
+        self.assertContains(response, "Dex · single sign-on")
+        self.assertEqual(response.context["free_services"], ["Dex · single sign-on", "Matrix · community chat"])
+        self.assertEqual(response.context["tiers"]["supporter"]["services"], ["Gitea · Git hosting"])
+        self.assertEqual(response.context["tiers"]["patron"]["services"], ["Mastodon · social networking", "PeerTube · video sharing"])
+        self.assertEqual(response.context["tiers"]["premier"]["services"], [])
+        self.assertNotContains(response, BASE)
+        self.assertNotIn("services", TIERS["supporter"])
+
+    @override_settings(MEMBERSHIP_SERVICE_GROUPS={})
+    def test_unconfigured_services_do_not_advertise_access(self):
+        response = self.client.get("/members/")
+        self.assertContains(response, "No additional service access is currently configured.")
+        self.assertNotContains(response, "Mastodon · social networking")
+
+    @override_settings(MEMBERSHIP_SERVICE_GROUPS={"0": [r"cn=\<script\>alert(1)\</script\>," + BASE]})
+    def test_group_labels_are_html_escaped(self):
+        response = self.client.get("/members/")
+        self.assertContains(response, "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertNotContains(response, "<script>alert(1)</script>")
+
+    def test_custom_labels_decode_dn_escapes_and_hide_hierarchy(self):
+        self.assertEqual(service_names(0, {"0": [r"cn=Games\, Friends Users," + BASE]}), ["Games, Friends"])
+        self.assertEqual(service_names(0, {"0": [r"cn=Caf\c3\a9 Users," + BASE]}), ["Café"])
+        self.assertEqual(service_names(0, {"0": ["ou=services," + BASE]}), ["Additional community service"])
+
+
 class ServiceGroupValidationTests(SimpleTestCase):
     def test_valid_mapping_is_returned_unchanged(self):
         self.assertIs(validate_service_groups(SERVICE_GROUPS, {1, 2, 10}), SERVICE_GROUPS)