miki-template 1.2.0

package/tests/filters.test.js

@@ -0,0 +1,99 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { getFilter } = require('../src/filters');
+
+test('Filters - Text filters', () => {
+  const upper = getFilter('upper');
+  assert.strictEqual(upper('hello'), 'HELLO');
+
+  const capfirst = getFilter('capfirst');
+  assert.strictEqual(capfirst('hello'), 'Hello');
+
+  const truncatewords = getFilter('truncatewords');
+  assert.strictEqual(truncatewords('one two three four', 2), 'one two ...');
+
+  const slugify = getFilter('slugify');
+  assert.strictEqual(slugify('Hello World! New-Post'), 'hello-world-new-post');
+});
+
+test('Filters - HTML / Security filters', () => {
+  const safe = getFilter('safe');
+  const escape = getFilter('escape');
+
+  assert.strictEqual(String(escape('<script>')), '&lt;script&gt;');
+  // Safe returns SafeString which resolves when cast to string
+  assert.strictEqual(String(safe('<p>')), '<p>');
+});
+
+test('Filters - List filters', () => {
+  const length = getFilter('length');
+  assert.strictEqual(length([1, 2, 3]), 3);
+
+  const join = getFilter('join');
+  assert.strictEqual(join(['a', 'b', 'c'], '-'), 'a-b-c');
+
+  const slice = getFilter('slice');
+  assert.deepEqual(slice([1, 2, 3, 4], '1:3'), [2, 3]);
+});
+
+test('Filters - Default filters', () => {
+  const def = getFilter('default');
+  assert.strictEqual(def(null, 'fallback'), 'fallback');
+  assert.strictEqual(def('value', 'fallback'), 'value');
+});
+
+test('Filters - Misc filters', () => {
+  const pluralize = getFilter('pluralize');
+  assert.strictEqual(pluralize(1), '');
+  assert.strictEqual(pluralize(2), 's');
+  assert.strictEqual(pluralize(1, 'y,ies'), 'y');
+  assert.strictEqual(pluralize(2, 'y,ies'), 'ies');
+});
+
+test('Filters - urlencode and escapeuri', () => {
+  const urlencode = getFilter('urlencode');
+  assert.strictEqual(urlencode('hello world'), 'hello+world');
+  assert.strictEqual(urlencode('a b c'), 'a+b+c');
+
+  const escapeuri = getFilter('escapeuri');
+  assert.ok(escapeuri('http://example.com/path with spaces').includes('path%20with%20spaces'));
+});
+
+test('Filters - stringformat', () => {
+  const stringformat = getFilter('stringformat');
+  assert.strictEqual(stringformat('hello', '%s'), 'hello');
+  assert.strictEqual(stringformat(42, '%d'), '42');
+  assert.strictEqual(stringformat(3.14159, '%.2f'), '3.14');
+});
+
+test('Filters - cut and addslashes', () => {
+  const cut = getFilter('cut');
+  assert.strictEqual(cut('hello hello', ' '), 'hellohello');
+
+  const addslashes = getFilter('addslashes');
+  assert.strictEqual(addslashes('He said "Hi"'), 'He said \\"Hi\\"');
+});
+
+test('Filters - length_is', () => {
+  const length_is = getFilter('length_is');
+  assert.strictEqual(length_is([1, 2, 3], 3), true);
+  assert.strictEqual(length_is([1, 2], 3), false);
+});
+
+test('Filter chaining via template', () => {
+  const { render } = require('../src/index');
+  const result = render('{{ value|lower|capfirst }}', { value: 'Hello World' });
+  assert.strictEqual(result, 'Hello world');
+
+  const result2 = render('{{ items|length|add:5 }}', { items: [1, 2, 3] });
+  assert.strictEqual(result2, '8');
+});
+
+test('Filter chaining on string literal', () => {
+  const { render } = require('../src/index');
+  const result = render('{{ "Hello World"|lower|capfirst }}', {});
+  assert.strictEqual(result, 'Hello world');
+
+  const result2 = render('{{ "  trim me  "|cut:" " }}', {});
+  assert.strictEqual(result2, 'trimme');
+});

package/tests/include_security.test.js

@@ -0,0 +1,9 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { render } = require('../src/index');
+
+test('Security - include path traversal prevented', () => {
+  const tpl = `{% include "../secret.html" %}`;
+  // Expect an error indicating path traversal
+  assert.throws(() => render(tpl, {}, { views: '.' }), /path traversal/);
+});

package/tests/lexer.test.js

@@ -0,0 +1,45 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { tokenize } = require('../src/lexer');
+
+test('Lexer - plain text tokenizing', () => {
+  const tokens = tokenize('Hello World');
+  assert.strictEqual(tokens.length, 1);
+  assert.strictEqual(tokens[0].type, 'text');
+  assert.strictEqual(tokens[0].content, 'Hello World');
+});
+
+test('Lexer - variable tokenizing', () => {
+  const tokens = tokenize('Hello {{ name }}!');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].content, 'Hello ');
+  assert.strictEqual(tokens[1].type, 'var');
+  assert.strictEqual(tokens[1].content, 'name');
+  assert.strictEqual(tokens[2].content, '!');
+});
+
+test('Lexer - block tag tokenizing', () => {
+  const tokens = tokenize('{% if active %}Yes{% endif %}');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].type, 'block');
+  assert.strictEqual(tokens[0].content, 'if active');
+  assert.strictEqual(tokens[1].content, 'Yes');
+  assert.strictEqual(tokens[2].type, 'block');
+  assert.strictEqual(tokens[2].content, 'endif');
+});
+
+test('Lexer - inline comment exclusion', () => {
+  const tokens = tokenize('Before {# comment #} After');
+  assert.strictEqual(tokens.length, 2);
+  assert.strictEqual(tokens[0].content, 'Before ');
+  assert.strictEqual(tokens[1].content, ' After');
+});
+
+test('Lexer - verbatim tag handling', () => {
+  const tokens = tokenize('Text {% verbatim %} {{ unparsed }} {% endverbatim %} End');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].content, 'Text ');
+  assert.strictEqual(tokens[1].type, 'text');
+  assert.strictEqual(tokens[1].content, ' {{ unparsed }} ');
+  assert.strictEqual(tokens[2].content, ' End');
+});

package/tests/parser.test.js

@@ -0,0 +1,55 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { parseVariableExpression } = require('../src/parser');
+const { Context } = require('../src/context');
+
+test('Parser - variable expression parsing', () => {
+  const res = parseVariableExpression('user.name|lower|default:"Guest"');
+  assert.strictEqual(res.varPath, 'user.name');
+  assert.strictEqual(res.filters.length, 2);
+  
+  assert.strictEqual(res.filters[0].name, 'lower');
+  assert.strictEqual(res.filters[0].arg, null);
+
+  assert.strictEqual(res.filters[1].name, 'default');
+  assert.strictEqual(res.filters[1].arg.type, 'literal');
+  assert.strictEqual(res.filters[1].arg.value, 'Guest');
+});
+
+test('Context - basic dotted lookups', () => {
+  const ctx = new Context({
+    user: {
+      profile: {
+        name: 'Miki',
+        age: 30
+      }
+    },
+    items: ['apple', 'banana']
+  });
+
+  assert.strictEqual(ctx.get('user.profile.name'), 'Miki');
+  assert.strictEqual(ctx.get('user.profile.age'), 30);
+  assert.strictEqual(ctx.get('items.1'), 'banana');
+  assert.strictEqual(ctx.get('user.profile.missing'), '');
+});
+
+test('Context - scope pushing and popping', () => {
+  const ctx = new Context({ name: 'Global' });
+  ctx.push({ name: 'Local', age: 25 });
+  
+  assert.strictEqual(ctx.get('name'), 'Local');
+  assert.strictEqual(ctx.get('age'), 25);
+
+  ctx.pop();
+  assert.strictEqual(ctx.get('name'), 'Global');
+  assert.strictEqual(ctx.get('age'), '');
+});
+
+test('Context - automatic function calling', () => {
+  const ctx = new Context({
+    user: {
+      getName: () => 'Dynamic Name'
+    }
+  });
+  assert.strictEqual(ctx.get('user.getName'), 'Dynamic Name');
+});

package/tests/partial.html

@@ -0,0 +1 @@
+<p>Included: {{ item }}</p>

package/tests/partialdef.test.js

@@ -0,0 +1,40 @@
+// tests for partialdef support, including conditionals, loops, and inline rendering
+const test = require('node:test');
+const assert = require('node:assert');
+const { render, compile } = require('../src/index');
+
+// Basic partialdef rendering via {% partial %}
+test('Partialdef basic rendering', () => {
+  const tpl = `{% partialdef greeting %}Hello {{ name }}{% endpartialdef %}{% partial greeting %}`;
+  const out = render(tpl, { name: 'Miki' });
+  assert.strictEqual(out, 'Hello Miki');
+});
+
+// Partialdef with conditional logic
+test('Partialdef with if/else', () => {
+  const tpl = `{% partialdef cond %}{% if show %}Visible{% else %}Hidden{% endif %}{% endpartialdef %}{% partial cond %}`;
+  assert.strictEqual(render(tpl, { show: true }), 'Visible');
+  assert.strictEqual(render(tpl, { show: false }), 'Hidden');
+});
+
+// Partialdef with loop and metadata
+test('Partialdef with for loop', () => {
+  const tpl = `{% partialdef list %}{% for item in items %}{{ item }},{% empty %}none{% endfor %}{% endpartialdef %}{% partial list %}`;
+  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), 'a,b,');
+  assert.strictEqual(render(tpl, { items: [] }), 'none');
+});
+
+// Inline partialdef (renders immediately)
+test('Inline partialdef renders inline', () => {
+  const tpl = `{% partialdef inline_example inline %}Inline {{ val }}{% endpartialdef %}`;
+  const out = render(tpl, { val: 'X' });
+  assert.strictEqual(out, 'Inline X');
+});
+
+// Rendering a partial via compile.renderPartial API
+test('renderPartial API works', () => {
+  const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
+  const compiled = compile(tpl);
+  const out = compiled.renderPartial('api', { data: 123 });
+  assert.strictEqual(out, 'API 123');
+});

package/tests/production_checks.js

@@ -0,0 +1,57 @@
+// Production readiness checks
+const { render, compile } = require('../src/index');
+const checks = [];
+
+try {
+  render('{% if x %}hello', {});
+  checks.push('FAIL: should throw on unclosed if');
+} catch(e) {
+  checks.push('OK: unclosed if throws: ' + e.message.slice(0, 50));
+}
+
+try {
+  render('{{ x|nonexistent }}', { x: 'hi' });
+  checks.push('FAIL: should throw on unknown filter');
+} catch(e) {
+  checks.push('OK: unknown filter throws: ' + e.message.slice(0, 50));
+}
+
+try {
+  render('{% nonexistent_tag %}', {});
+  checks.push('FAIL: should throw on unknown tag');
+} catch(e) {
+  checks.push('OK: unknown tag throws: ' + e.message.slice(0, 50));
+}
+
+const xss = render('{{ x }}', { x: '<script>alert(1)</script>' });
+checks.push(xss.includes('&lt;script&gt;') ? 'OK: XSS auto-escaped' : 'FAIL: XSS not escaped');
+
+const safe = render('{{ x|safe }}', { x: '<b>bold</b>' });
+checks.push(safe === '<b>bold</b>' ? 'OK: safe filter works' : 'FAIL: safe: ' + safe);
+
+const c1 = compile('{% cycle a b c %}');
+const r1 = c1.render({});
+const r2 = c1.render({});
+checks.push(r1 !== r2 ? 'OK: cycle resets' : 'WARN: cycle state: ' + r1 + '/' + r2);
+
+try {
+  render('{{ x }}', { x: 'a'.repeat(100000) });
+  checks.push('OK: handles large input');
+} catch(e) {
+  checks.push('FAIL: large input: ' + e.message);
+}
+
+const nullTest = render('{{ x }}', { x: null });
+checks.push(nullTest === '' ? 'OK: null renders empty' : 'FAIL: null=' + nullTest);
+
+try {
+  render('{% extends "../etc/passwd" %}', {});
+  checks.push('FAIL: path traversal not blocked');
+} catch(e) {
+  checks.push('OK: path traversal blocked: ' + e.message.slice(0, 50));
+}
+
+const nested = render('{% for i in outer %}{% for j in i %}{{ forloop.parentloop.counter }}.{{ forloop.counter }} {% endfor %}{% endfor %}', { outer: [[1,2],[3,4]] });
+checks.push(nested.trim() === '1.1 1.2 2.1 2.2' ? 'OK: nested forloop' : 'WARN nested: ' + nested);
+
+console.log(checks.join('\n'));

package/tests/security.test.js

@@ -0,0 +1,28 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { render, markSafe } = require('../src/index');
+
+test('Security - HTML Auto-escaping enabled by default', () => {
+  const tpl = '{{ value }}';
+  const output = render(tpl, { value: '<script>alert("xss")</script>' });
+  assert.strictEqual(output, '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
+});
+
+test('Security - safe filter disables escaping', () => {
+  const tpl = '{{ value|safe }}';
+  const output = render(tpl, { value: '<b>Hello</b>' });
+  assert.strictEqual(output, '<b>Hello</b>');
+});
+
+test('Security - escape filter forces escaping', () => {
+  // In autoescape off mode, escape filter still escapes
+  const tpl = '{% autoescape off %}{{ value|escape }}{% endautoescape %}';
+  const output = render(tpl, { value: '<b>Hello</b>' });
+  assert.strictEqual(output, '&lt;b&gt;Hello&lt;/b&gt;');
+});
+
+test('Security - markSafe variables bypassed', () => {
+  const tpl = '{{ value }}';
+  const output = render(tpl, { value: markSafe('<h1>Title</h1>') });
+  assert.strictEqual(output, '<h1>Title</h1>');
+});

package/tests/tags.test.js

@@ -0,0 +1,203 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const { render, compile } = require('../src/index');
+
+test('Tags - If / Elif / Else', () => {
+  const tpl = '{% if value == 1 %}One{% elif value == 2 %}Two{% else %}Other{% endif %}';
+  assert.strictEqual(render(tpl, { value: 1 }), 'One');
+  assert.strictEqual(render(tpl, { value: 2 }), 'Two');
+  assert.strictEqual(render(tpl, { value: 3 }), 'Other');
+});
+
+test('Tags - For loop with empty and unpack', () => {
+  const tpl = '{% for x in items %}{{ x }}{% empty %}No items{% endfor %}';
+  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), 'ab');
+  assert.strictEqual(render(tpl, { items: [] }), 'No items');
+});
+
+test('Tags - For loop loop metadata', () => {
+  const tpl = '{% for x in items %}{{ forloop.counter }}:{{ x }}{% if not forloop.last %},{% endif %}{% endfor %}';
+  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), '1:a,2:b');
+});
+
+test('Tags - With scope blocks', () => {
+  const tpl = '{% with a=x b=y %}{{ a }}-{{ b }}{% endwith %}';
+  assert.strictEqual(render(tpl, { x: 10, y: 20 }), '10-20');
+});
+
+test('Tags - Cycle alternating tags', () => {
+  const tpl = '{% for x in items %}{% cycle "odd" "even" %} {% endfor %}';
+  assert.strictEqual(render(tpl, { items: [1, 2, 3] }), 'odd even odd ');
+});
+
+test('Tags - Template inheritance and block.super', () => {
+  const views = __dirname;
+  const childTpl = '{% extends "child.html" %}';
+  const output = render(childTpl, {}, { views });
+  
+  assert.match(output, /Child Header/);
+  assert.match(output, /Default Header/);
+  assert.match(output, /Child Content/);
+});
+
+test('Tags - Include tag', () => {
+  const views = __dirname;
+  const tpl = '{% include "partial.html" with item="Apple" %}';
+  const output = render(tpl, {}, { views });
+  assert.strictEqual(output.trim(), '<p>Included: Apple</p>');
+});
+
+test('Tags - Regroup array by property', () => {
+  const people = [
+    { name: 'Miki', gender: 'male' },
+    { name: 'Anna', gender: 'female' },
+    { name: 'John', gender: 'male' }
+  ];
+  const tpl = '{% regroup people by gender as grouped %}{% for g in grouped %}{{ g.grouper }}:{% for p in g.list %}{{ p.name }}{% endfor %} {% endfor %}';
+  assert.strictEqual(render(tpl, { people }), 'male:MikiJohn female:Anna ');
+});
+
+test('Tags - Spaceless HTML formatting', () => {
+  const tpl = '{% spaceless %}  <div>  <p>  Hello  </p>  </div>  {% endspaceless %}';
+  assert.strictEqual(render(tpl), '  <div><p>  Hello  </p></div>  ');
+});
+
+test('Tags - Static file path generator', () => {
+  const tpl = '{% static "images/logo.png" %}';
+  assert.strictEqual(render(tpl, {}, { staticUrl: '/assets/' }), '/assets/images/logo.png');
+});
+
+test('Tags - Url mapping', () => {
+  const tpl = '{% url "user-profile" "miki" %}';
+  const urlHelper = (route, arg) => `/users/${arg}`;
+  assert.strictEqual(render(tpl, {}, { urlHelper }), '/users/miki');
+});
+
+test('Tags - csrf_token security tag', () => {
+  const tpl = '{% csrf_token %}';
+  const output = render(tpl, { csrf_token: '12345' });
+  assert.strictEqual(output, '<input type="hidden" name="csrfmiddlewaretoken" value="12345">');
+});
+
+test('Tags - csp_nonce_attr security tag', () => {
+  const tpl = '<script {% csp_nonce_attr %} src="app.js"></script>';
+  const output = render(tpl, { csp_nonce: 'xyz789' });
+  assert.strictEqual(output, '<script nonce="xyz789" src="app.js"></script>');
+
+  // If no nonce in context, output nothing
+  const outputEmpty = render(tpl, {});
+  assert.strictEqual(outputEmpty, '<script  src="app.js"></script>');
+});
+
+test('Tags - Partial Block Rendering via compile.renderBlock', () => {
+  const views = __dirname;
+  const childTpl = '{% extends "child.html" %}';
+  const compiled = compile(childTpl, { views });
+  
+  // Render only the 'content' block
+  const contentOnly = compiled.renderBlock('content');
+  assert.strictEqual(contentOnly, 'Child Content');
+
+  // Render only the 'header' block (which includes block.super)
+  const headerOnly = compiled.renderBlock('header');
+  assert.match(headerOnly, /Child Header/);
+  assert.match(headerOnly, /Default Header/);
+});
+
+test('Tags - templatetag', () => {
+  const output = render('{% templatetag openvariable %}hello{% templatetag closevariable %}', {});
+  assert.strictEqual(output, '{{hello}}');
+});
+
+test('Tags - templatetag openblock/closeblock', () => {
+  const output = render('{% templatetag openblock %}body{% templatetag closeblock %}', {});
+  assert.strictEqual(output, '{%body%}');
+});
+
+test('Tags - load', () => {
+  const output = render('{% load i18n %}', {});
+  assert.strictEqual(output, '');
+});
+
+test('Tags - unclosed if throws', () => {
+  assert.throws(() => {
+    render('{% if x %}hello', {});
+  }, /Unclosed.*if|endif/i);
+});
+
+test('Tags - unclosed for throws', () => {
+  assert.throws(() => {
+    render('{% for x in items %}{{ x }}', { items: [1, 2] });
+  }, /Unexpected end|endfor/i);
+});
+
+test('Tags - unclosed with throws', () => {
+  assert.throws(() => {
+    render('{% with a=b %}{{ a }}', { b: 1 });
+  }, /Unexpected end|endwith/i);
+});
+
+test('Tags - widthratio', () => {
+  // 25 out of 100 with max width 150 = floor(25/100 * 150) = 37
+  assert.strictEqual(render('{% widthratio 25 100 150 %}', {}), '37');
+  // Edge cases
+  assert.strictEqual(render('{% widthratio 0 100 150 %}', {}), '0');
+  assert.strictEqual(render('{% widthratio 100 100 150 %}', {}), '150');
+  assert.strictEqual(render('{% widthratio 200 100 150 %}', {}), '150');
+});
+
+test('Tags - debug', () => {
+  const output = render('{% debug %}', { foo: 'bar' });
+  assert.ok(output.includes('foo'));
+  assert.ok(output.includes('bar'));
+});
+
+test('Tags - i18n trans tag', () => {
+  const { setLanguage, registerTranslation, render } = require('../src/index');
+  registerTranslation('en', { 'Hello, World!': 'Bonjour, le monde !' });
+  setLanguage('en');
+  const output = render('{% trans "Hello, World!" %}', {});
+  assert.strictEqual(output, 'Bonjour, le monde !');
+});
+
+test('Tags - i18n language block', () => {
+  const { setLanguage, registerTranslation, render } = require('../src/index');
+  registerTranslation('fr', { 'Welcome': 'Bienvenue' });
+  const output = render('{% language "fr" %}{% trans "Welcome" %}{% endlanguage %}', {});
+  assert.strictEqual(output, 'Bienvenue');
+});
+
+test('Tags - load with real library', () => {
+  const { render, registerLibrary } = require('../src/index');
+  registerLibrary('mytestlib', {
+    filters: {
+      shout: (val) => String(val).toUpperCase() + '!'
+    }
+  });
+  const output = render('{% load mytestlib %}{{ "hello"|shout }}', {});
+  assert.strictEqual(output, 'HELLO!');
+});
+
+test('Tags - regroup filter', () => {
+  const { render } = require('../src/index');
+  const items = [
+    { category: 'A', name: 'a1' },
+    { category: 'B', name: 'b1' },
+    { category: 'A', name: 'a2' }
+  ];
+  const output = render(
+    '{% for g in items|regroup:"category" %}{{ g.grouper }}{% for i in g.list %}{{ i.name }}{% endfor %}{% endfor %}',
+    { items }
+  );
+  assert.strictEqual(output, 'Aa1a2Bb1');
+});
+
+test('Filters - strftime with date-fns', () => {
+  const { render, getFilter } = require('../src/index');
+  const strftime = getFilter('strftime');
+  const result = strftime(new Date('2026-08-31T22:00:00'), 'yyyy-MM-dd');
+  assert.strictEqual(result, '2026-08-31');
+  const result2 = strftime(new Date('2026-08-31T22:00:00'), 'HH:mm');
+  assert.ok(result2.startsWith('22:'));
+});