miki-template 1.2.0 → 1.3.6

package/tests/integration/templates/base.miki

@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+  {% block content %}Default content from base{% endblock %}
+</body>
+</html>

package/tests/integration/templates/child.miki

@@ -0,0 +1,6 @@
+{% extends "base.miki" %}
+{% block content %}
+  <h1>{{ heading }}</h1>
+  <p>Welcome, {{ user.name }}!</p>
+  {{ block.super }}
+{% endblock %}

package/tests/integration/templates/index.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>{{ title }}</title>
+</head>
+<body>
+  <h1>{{ heading }}</h1>
+  <ul>
+  {% for item in items %}
+    <li>{{ forloop.counter }}: {{ item|upper }}</li>
+  {% empty %}
+    <li>No items</li>
+  {% endfor %}
+  </ul>
+  <p>User: {{ user.name|title }}</p>
+</body>
+</html>

package/tests/lexer.test.js

@@ -1,45 +1,45 @@
-const test = require('node:test');
-const assert = require('node:assert');
-const { tokenize } = require('../src/lexer');
-
-test('Lexer - plain text tokenizing', () => {
-  const tokens = tokenize('Hello World');
-  assert.strictEqual(tokens.length, 1);
-  assert.strictEqual(tokens[0].type, 'text');
-  assert.strictEqual(tokens[0].content, 'Hello World');
-});
-
-test('Lexer - variable tokenizing', () => {
-  const tokens = tokenize('Hello {{ name }}!');
-  assert.strictEqual(tokens.length, 3);
-  assert.strictEqual(tokens[0].content, 'Hello ');
-  assert.strictEqual(tokens[1].type, 'var');
-  assert.strictEqual(tokens[1].content, 'name');
-  assert.strictEqual(tokens[2].content, '!');
-});
-
-test('Lexer - block tag tokenizing', () => {
-  const tokens = tokenize('{% if active %}Yes{% endif %}');
-  assert.strictEqual(tokens.length, 3);
-  assert.strictEqual(tokens[0].type, 'block');
-  assert.strictEqual(tokens[0].content, 'if active');
-  assert.strictEqual(tokens[1].content, 'Yes');
-  assert.strictEqual(tokens[2].type, 'block');
-  assert.strictEqual(tokens[2].content, 'endif');
-});
-
-test('Lexer - inline comment exclusion', () => {
-  const tokens = tokenize('Before {# comment #} After');
-  assert.strictEqual(tokens.length, 2);
-  assert.strictEqual(tokens[0].content, 'Before ');
-  assert.strictEqual(tokens[1].content, ' After');
-});
-
-test('Lexer - verbatim tag handling', () => {
-  const tokens = tokenize('Text {% verbatim %} {{ unparsed }} {% endverbatim %} End');
-  assert.strictEqual(tokens.length, 3);
-  assert.strictEqual(tokens[0].content, 'Text ');
-  assert.strictEqual(tokens[1].type, 'text');
-  assert.strictEqual(tokens[1].content, ' {{ unparsed }} ');
-  assert.strictEqual(tokens[2].content, ' End');
-});
+const test = require('node:test');
+const assert = require('node:assert');
+const { tokenize } = require('../src/lexer');
+
+test('Lexer - plain text tokenizing', () => {
+  const tokens = tokenize('Hello World');
+  assert.strictEqual(tokens.length, 1);
+  assert.strictEqual(tokens[0].type, 'text');
+  assert.strictEqual(tokens[0].content, 'Hello World');
+});
+
+test('Lexer - variable tokenizing', () => {
+  const tokens = tokenize('Hello {{ name }}!');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].content, 'Hello ');
+  assert.strictEqual(tokens[1].type, 'var');
+  assert.strictEqual(tokens[1].content, 'name');
+  assert.strictEqual(tokens[2].content, '!');
+});
+
+test('Lexer - block tag tokenizing', () => {
+  const tokens = tokenize('{% if active %}Yes{% endif %}');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].type, 'block');
+  assert.strictEqual(tokens[0].content, 'if active');
+  assert.strictEqual(tokens[1].content, 'Yes');
+  assert.strictEqual(tokens[2].type, 'block');
+  assert.strictEqual(tokens[2].content, 'endif');
+});
+
+test('Lexer - inline comment exclusion', () => {
+  const tokens = tokenize('Before {# comment #} After');
+  assert.strictEqual(tokens.length, 2);
+  assert.strictEqual(tokens[0].content, 'Before ');
+  assert.strictEqual(tokens[1].content, ' After');
+});
+
+test('Lexer - verbatim tag handling', () => {
+  const tokens = tokenize('Text {% verbatim %} {{ unparsed }} {% endverbatim %} End');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].content, 'Text ');
+  assert.strictEqual(tokens[1].type, 'text');
+  assert.strictEqual(tokens[1].content, ' {{ unparsed }} ');
+  assert.strictEqual(tokens[2].content, ' End');
+});

package/tests/parser.test.js

@@ -1,55 +1,57 @@
-const test = require('node:test');
-const assert = require('node:assert');
-const { parseVariableExpression } = require('../src/parser');
-const { Context } = require('../src/context');
-
-test('Parser - variable expression parsing', () => {
-  const res = parseVariableExpression('user.name|lower|default:"Guest"');
-  assert.strictEqual(res.varPath, 'user.name');
-  assert.strictEqual(res.filters.length, 2);
-  
-  assert.strictEqual(res.filters[0].name, 'lower');
-  assert.strictEqual(res.filters[0].arg, null);
-
-  assert.strictEqual(res.filters[1].name, 'default');
-  assert.strictEqual(res.filters[1].arg.type, 'literal');
-  assert.strictEqual(res.filters[1].arg.value, 'Guest');
-});
-
-test('Context - basic dotted lookups', () => {
-  const ctx = new Context({
-    user: {
-      profile: {
-        name: 'Miki',
-        age: 30
-      }
-    },
-    items: ['apple', 'banana']
-  });
-
-  assert.strictEqual(ctx.get('user.profile.name'), 'Miki');
-  assert.strictEqual(ctx.get('user.profile.age'), 30);
-  assert.strictEqual(ctx.get('items.1'), 'banana');
-  assert.strictEqual(ctx.get('user.profile.missing'), '');
-});
-
-test('Context - scope pushing and popping', () => {
-  const ctx = new Context({ name: 'Global' });
-  ctx.push({ name: 'Local', age: 25 });
-  
-  assert.strictEqual(ctx.get('name'), 'Local');
-  assert.strictEqual(ctx.get('age'), 25);
-
-  ctx.pop();
-  assert.strictEqual(ctx.get('name'), 'Global');
-  assert.strictEqual(ctx.get('age'), '');
-});
-
-test('Context - automatic function calling', () => {
-  const ctx = new Context({
-    user: {
-      getName: () => 'Dynamic Name'
-    }
-  });
-  assert.strictEqual(ctx.get('user.getName'), 'Dynamic Name');
-});
+const test = require('node:test');
+const assert = require('node:assert');
+const { parseVariableExpression } = require('../src/parser');
+const { Context } = require('../src/context');
+
+test('Parser - variable expression parsing', () => {
+  const res = parseVariableExpression('user.name|lower|default:"Guest"');
+  assert.strictEqual(res.varPath, 'user.name');
+  assert.strictEqual(res.filters.length, 2);
+  
+  assert.strictEqual(res.filters[0].name, 'lower');
+  assert.strictEqual(res.filters[0].arg, null);
+
+  assert.strictEqual(res.filters[1].name, 'default');
+  assert.strictEqual(res.filters[1].arg.type, 'literal');
+  assert.strictEqual(res.filters[1].arg.value, 'Guest');
+});
+
+test('Context - basic dotted lookups', () => {
+  const ctx = new Context({
+    user: {
+      profile: {
+        name: 'Miki',
+        age: 30
+      }
+    },
+    items: ['apple', 'banana']
+  });
+
+  assert.strictEqual(ctx.get('user.profile.name'), 'Miki');
+  assert.strictEqual(ctx.get('user.profile.age'), 30);
+  assert.strictEqual(ctx.get('items.1'), 'banana');
+  // Missing key now returns undefined (so filters like default_if_none
+  // can detect missing values) instead of empty string.
+  assert.strictEqual(ctx.get('user.profile.missing'), undefined);
+});
+
+test('Context - scope pushing and popping', () => {
+  const ctx = new Context({ name: 'Global' });
+  ctx.push({ name: 'Local', age: 25 });
+
+  assert.strictEqual(ctx.get('name'), 'Local');
+  assert.strictEqual(ctx.get('age'), 25);
+
+  ctx.pop();
+  assert.strictEqual(ctx.get('name'), 'Global');
+  assert.strictEqual(ctx.get('age'), undefined);
+});
+
+test('Context - automatic function calling', () => {
+  const ctx = new Context({
+    user: {
+      getName: () => 'Dynamic Name'
+    }
+  });
+  assert.strictEqual(ctx.get('user.getName'), 'Dynamic Name');
+});

package/tests/partial.html

@@ -1 +1 @@
-<p>Included: {{ item }}</p>
+<p>Included: {{ item }}</p>

package/tests/partialdef.test.js

@@ -1,40 +1,79 @@
-// tests for partialdef support, including conditionals, loops, and inline rendering
-const test = require('node:test');
-const assert = require('node:assert');
-const { render, compile } = require('../src/index');
-
-// Basic partialdef rendering via {% partial %}
-test('Partialdef basic rendering', () => {
-  const tpl = `{% partialdef greeting %}Hello {{ name }}{% endpartialdef %}{% partial greeting %}`;
-  const out = render(tpl, { name: 'Miki' });
-  assert.strictEqual(out, 'Hello Miki');
-});
-
-// Partialdef with conditional logic
-test('Partialdef with if/else', () => {
-  const tpl = `{% partialdef cond %}{% if show %}Visible{% else %}Hidden{% endif %}{% endpartialdef %}{% partial cond %}`;
-  assert.strictEqual(render(tpl, { show: true }), 'Visible');
-  assert.strictEqual(render(tpl, { show: false }), 'Hidden');
-});
-
-// Partialdef with loop and metadata
-test('Partialdef with for loop', () => {
-  const tpl = `{% partialdef list %}{% for item in items %}{{ item }},{% empty %}none{% endfor %}{% endpartialdef %}{% partial list %}`;
-  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), 'a,b,');
-  assert.strictEqual(render(tpl, { items: [] }), 'none');
-});
-
-// Inline partialdef (renders immediately)
-test('Inline partialdef renders inline', () => {
-  const tpl = `{% partialdef inline_example inline %}Inline {{ val }}{% endpartialdef %}`;
-  const out = render(tpl, { val: 'X' });
-  assert.strictEqual(out, 'Inline X');
-});
-
-// Rendering a partial via compile.renderPartial API
-test('renderPartial API works', () => {
-  const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
-  const compiled = compile(tpl);
-  const out = compiled.renderPartial('api', { data: 123 });
-  assert.strictEqual(out, 'API 123');
-});
+// tests for partialdef support, including conditionals, loops, and inline rendering
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const { render, compile, renderPartialFromSource } = require('../src/index');
+
+// Basic partialdef rendering via {% partial %}
+test('Partialdef basic rendering', () => {
+  const tpl = `{% partialdef greeting %}Hello {{ name }}{% endpartialdef %}{% partial greeting %}`;
+  const out = render(tpl, { name: 'Miki' });
+  assert.strictEqual(out, 'Hello Miki');
+});
+
+// Partialdef with conditional logic
+test('Partialdef with if/else', () => {
+  const tpl = `{% partialdef cond %}{% if show %}Visible{% else %}Hidden{% endif %}{% endpartialdef %}{% partial cond %}`;
+  assert.strictEqual(render(tpl, { show: true }), 'Visible');
+  assert.strictEqual(render(tpl, { show: false }), 'Hidden');
+});
+
+// Partialdef with loop and metadata
+test('Partialdef with for loop', () => {
+  const tpl = `{% partialdef list %}{% for item in items %}{{ item }},{% empty %}none{% endfor %}{% endpartialdef %}{% partial list %}`;
+  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), 'a,b,');
+  assert.strictEqual(render(tpl, { items: [] }), 'none');
+});
+
+// Inline partialdef (renders immediately)
+test('Inline partialdef renders inline', () => {
+  const tpl = `{% partialdef inline_example inline %}Inline {{ val }}{% endpartialdef %}`;
+  const out = render(tpl, { val: 'X' });
+  assert.strictEqual(out, 'Inline X');
+});
+
+// Rendering a partial via compile.renderPartial API
+test('renderPartial API works', () => {
+  const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
+  const compiled = compile(tpl);
+  const out = compiled.renderPartial('api', { data: 123 });
+  assert.strictEqual(out, 'API 123');
+});
+
+// Bug fix: partials defined inside for loops are found by renderPartialFromSource
+test('renderPartialFromSource finds partials inside for loops', () => {
+  const tpl = `{% for item in items %}{% partialdef loop_item %}{{ item }}{% endpartialdef %}{% endfor %}`;
+  const out = renderPartialFromSource(tpl, 'loop_item', { item: 'X' });
+  assert.strictEqual(out, 'X');
+});
+
+// Bug fix: include with partial selector does not leak other partials from included file
+test('include with partial selector does not leak other partials', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'miki-partial-'));
+  fs.writeFileSync(path.join(dir, 'main.html'), `{% include "frag.html#only_me" %}`);
+  fs.writeFileSync(path.join(dir, 'frag.html'), `{% partialdef only_me %}ME{% endpartialdef %}{% partialdef secret %}SECRET{% endpartialdef %}`);
+  
+  const mainTpl = fs.readFileSync(path.join(dir, 'main.html'), 'utf8');
+  assert.throws(
+    () => renderPartialFromSource(mainTpl, 'secret', {}, { views: dir }),
+    /Partial 'secret' not found/
+  );
+  
+  fs.rmSync(dir, { recursive: true });
+});
+
+// Bug fix: full include makes all partials from included file available
+test('full include makes all included partials available', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'miki-partial-full-'));
+  fs.writeFileSync(path.join(dir, 'main.html'), `{% include "frag.html" %}`);
+  fs.writeFileSync(path.join(dir, 'frag.html'), `{% partialdef only_me %}ME{% endpartialdef %}{% partialdef secret %}SECRET{% endpartialdef %}`);
+  
+  const mainTpl = fs.readFileSync(path.join(dir, 'main.html'), 'utf8');
+  const out = renderPartialFromSource(mainTpl, 'secret', {}, { views: dir });
+  assert.strictEqual(out, 'SECRET');
+  
+  fs.rmSync(dir, { recursive: true });
+});
+

package/tests/production_checks.js

@@ -1,57 +1,57 @@
-// Production readiness checks
-const { render, compile } = require('../src/index');
-const checks = [];
-
-try {
-  render('{% if x %}hello', {});
-  checks.push('FAIL: should throw on unclosed if');
-} catch(e) {
-  checks.push('OK: unclosed if throws: ' + e.message.slice(0, 50));
-}
-
-try {
-  render('{{ x|nonexistent }}', { x: 'hi' });
-  checks.push('FAIL: should throw on unknown filter');
-} catch(e) {
-  checks.push('OK: unknown filter throws: ' + e.message.slice(0, 50));
-}
-
-try {
-  render('{% nonexistent_tag %}', {});
-  checks.push('FAIL: should throw on unknown tag');
-} catch(e) {
-  checks.push('OK: unknown tag throws: ' + e.message.slice(0, 50));
-}
-
-const xss = render('{{ x }}', { x: '<script>alert(1)</script>' });
-checks.push(xss.includes('&lt;script&gt;') ? 'OK: XSS auto-escaped' : 'FAIL: XSS not escaped');
-
-const safe = render('{{ x|safe }}', { x: '<b>bold</b>' });
-checks.push(safe === '<b>bold</b>' ? 'OK: safe filter works' : 'FAIL: safe: ' + safe);
-
-const c1 = compile('{% cycle a b c %}');
-const r1 = c1.render({});
-const r2 = c1.render({});
-checks.push(r1 !== r2 ? 'OK: cycle resets' : 'WARN: cycle state: ' + r1 + '/' + r2);
-
-try {
-  render('{{ x }}', { x: 'a'.repeat(100000) });
-  checks.push('OK: handles large input');
-} catch(e) {
-  checks.push('FAIL: large input: ' + e.message);
-}
-
-const nullTest = render('{{ x }}', { x: null });
-checks.push(nullTest === '' ? 'OK: null renders empty' : 'FAIL: null=' + nullTest);
-
-try {
-  render('{% extends "../etc/passwd" %}', {});
-  checks.push('FAIL: path traversal not blocked');
-} catch(e) {
-  checks.push('OK: path traversal blocked: ' + e.message.slice(0, 50));
-}
-
-const nested = render('{% for i in outer %}{% for j in i %}{{ forloop.parentloop.counter }}.{{ forloop.counter }} {% endfor %}{% endfor %}', { outer: [[1,2],[3,4]] });
-checks.push(nested.trim() === '1.1 1.2 2.1 2.2' ? 'OK: nested forloop' : 'WARN nested: ' + nested);
-
-console.log(checks.join('\n'));
+// Production readiness checks
+const { render, compile } = require('../src/index');
+const checks = [];
+
+try {
+  render('{% if x %}hello', {});
+  checks.push('FAIL: should throw on unclosed if');
+} catch(e) {
+  checks.push('OK: unclosed if throws: ' + e.message.slice(0, 50));
+}
+
+try {
+  render('{{ x|nonexistent }}', { x: 'hi' });
+  checks.push('FAIL: should throw on unknown filter');
+} catch(e) {
+  checks.push('OK: unknown filter throws: ' + e.message.slice(0, 50));
+}
+
+try {
+  render('{% nonexistent_tag %}', {});
+  checks.push('FAIL: should throw on unknown tag');
+} catch(e) {
+  checks.push('OK: unknown tag throws: ' + e.message.slice(0, 50));
+}
+
+const xss = render('{{ x }}', { x: '<script>alert(1)</script>' });
+checks.push(xss.includes('&lt;script&gt;') ? 'OK: XSS auto-escaped' : 'FAIL: XSS not escaped');
+
+const safe = render('{{ x|safe }}', { x: '<b>bold</b>' });
+checks.push(safe === '<b>bold</b>' ? 'OK: safe filter works' : 'FAIL: safe: ' + safe);
+
+const c1 = compile('{% cycle a b c %}');
+const r1 = c1.render({});
+const r2 = c1.render({});
+checks.push(r1 !== r2 ? 'OK: cycle resets' : 'WARN: cycle state: ' + r1 + '/' + r2);
+
+try {
+  render('{{ x }}', { x: 'a'.repeat(100000) });
+  checks.push('OK: handles large input');
+} catch(e) {
+  checks.push('FAIL: large input: ' + e.message);
+}
+
+const nullTest = render('{{ x }}', { x: null });
+checks.push(nullTest === '' ? 'OK: null renders empty' : 'FAIL: null=' + nullTest);
+
+try {
+  render('{% extends "../etc/passwd" %}', {});
+  checks.push('FAIL: path traversal not blocked');
+} catch(e) {
+  checks.push('OK: path traversal blocked: ' + e.message.slice(0, 50));
+}
+
+const nested = render('{% for i in outer %}{% for j in i %}{{ forloop.parentloop.counter }}.{{ forloop.counter }} {% endfor %}{% endfor %}', { outer: [[1,2],[3,4]] });
+checks.push(nested.trim() === '1.1 1.2 2.1 2.2' ? 'OK: nested forloop' : 'WARN nested: ' + nested);
+
+console.log(checks.join('\n'));

package/tests/security.test.js

@@ -1,28 +1,28 @@
-const test = require('node:test');
-const assert = require('node:assert');
-const { render, markSafe } = require('../src/index');
-
-test('Security - HTML Auto-escaping enabled by default', () => {
-  const tpl = '{{ value }}';
-  const output = render(tpl, { value: '<script>alert("xss")</script>' });
-  assert.strictEqual(output, '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
-});
-
-test('Security - safe filter disables escaping', () => {
-  const tpl = '{{ value|safe }}';
-  const output = render(tpl, { value: '<b>Hello</b>' });
-  assert.strictEqual(output, '<b>Hello</b>');
-});
-
-test('Security - escape filter forces escaping', () => {
-  // In autoescape off mode, escape filter still escapes
-  const tpl = '{% autoescape off %}{{ value|escape }}{% endautoescape %}';
-  const output = render(tpl, { value: '<b>Hello</b>' });
-  assert.strictEqual(output, '&lt;b&gt;Hello&lt;/b&gt;');
-});
-
-test('Security - markSafe variables bypassed', () => {
-  const tpl = '{{ value }}';
-  const output = render(tpl, { value: markSafe('<h1>Title</h1>') });
-  assert.strictEqual(output, '<h1>Title</h1>');
-});
+const test = require('node:test');
+const assert = require('node:assert');
+const { render, markSafe } = require('../src/index');
+
+test('Security - HTML Auto-escaping enabled by default', () => {
+  const tpl = '{{ value }}';
+  const output = render(tpl, { value: '<script>alert("xss")</script>' });
+  assert.strictEqual(output, '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
+});
+
+test('Security - safe filter disables escaping', () => {
+  const tpl = '{{ value|safe }}';
+  const output = render(tpl, { value: '<b>Hello</b>' });
+  assert.strictEqual(output, '<b>Hello</b>');
+});
+
+test('Security - escape filter forces escaping', () => {
+  // In autoescape off mode, escape filter still escapes
+  const tpl = '{% autoescape off %}{{ value|escape }}{% endautoescape %}';
+  const output = render(tpl, { value: '<b>Hello</b>' });
+  assert.strictEqual(output, '&lt;b&gt;Hello&lt;/b&gt;');
+});
+
+test('Security - markSafe variables bypassed', () => {
+  const tpl = '{{ value }}';
+  const output = render(tpl, { value: markSafe('<h1>Title</h1>') });
+  assert.strictEqual(output, '<h1>Title</h1>');
+});