From c5492398f100ccb154fa557d657bae2322f95cf7 Mon Sep 17 00:00:00 2001
From: Dennis Fink
Date: Fri, 21 Aug 2026 10:37:56 +0200
Subject: test(core): align tests with module ownership

Move direct validator, model, and Huey extension coverage into dedicated
test modules and mock dependencies where behavior belongs to another
module.

Expand Huey extension typing and coverage while removing duplicate
assertions from scanner, sender, form, and view tests.
---
 tests/forms/test_forms.py | 115 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 tests/forms/test_forms.py

(limited to 'tests/forms/test_forms.py')

diff --git a/tests/forms/test_forms.py b/tests/forms/test_forms.py
new file mode 100644
index 0000000..6fe1849
--- /dev/null
+++ b/tests/forms/test_forms.py
@@ -0,0 +1,115 @@
+# SPDX-FileCopyrightText: 2026 Dennis Fink <me+coding@dennisfink.me>
+#
+# SPDX-License-Identifier: BSD-3-Clause
+
+from unittest.mock import Mock
+
+import pytest
+from flask import Flask
+from werkzeug.datastructures import MultiDict
+
+from webmentions_ssg.forms import AdminActionForm, EndpointForm, LoginForm
+
+VALID_SOURCE = "https://source.example/post"
+VALID_TARGET = "https://dennisfink.me/blog/example/"
+
+
+@pytest.fixture(autouse=True)
+def public_urls(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        "webmentions_ssg.forms.validators.is_public_url", Mock(return_value=True)
+    )
+
+
+@pytest.mark.parametrize(
+    ("form_data", "invalid_field", "expected_error"),
+    [
+        pytest.param(
+            {"target": VALID_TARGET},
+            "source",
+            "This field is required.",
+            id="source-required",
+        ),
+        pytest.param(
+            {"source": "not a URL", "target": VALID_TARGET},
+            "source",
+            "Invalid URL.",
+            id="source-url",
+        ),
+        pytest.param(
+            {"source": "ftp://source.example/post", "target": VALID_TARGET},
+            "source",
+            "source must begin with http or https",
+            id="source-scheme",
+        ),
+        pytest.param(
+            {"source": VALID_SOURCE},
+            "target",
+            "This field is required.",
+            id="target-required",
+        ),
+        pytest.param(
+            {"source": VALID_SOURCE, "target": "not a URL"},
+            "target",
+            "Invalid URL.",
+            id="target-url",
+        ),
+        pytest.param(
+            {"source": VALID_SOURCE, "target": "ftp://dennisfink.me/blog/example/"},
+            "target",
+            "target must begin with http or https",
+            id="target-scheme",
+        ),
+    ],
+)
+def test_endpoint_form_rejects_invalid_field_syntax(
+    app: Flask, form_data: dict[str, str], invalid_field: str, expected_error: str
+) -> None:
+    with app.test_request_context("/endpoint", method="POST"):
+        form = EndpointForm(formdata=MultiDict(form_data), meta={"csrf": False})
+
+        assert not form.validate()
+        assert expected_error in form.errors[invalid_field]
+
+
+def test_endpoint_form_accepts_valid_data(app: Flask) -> None:
+    with app.test_request_context("/endpoint", method="POST"):
+        form = EndpointForm(
+            formdata=MultiDict({"source": VALID_SOURCE, "target": VALID_TARGET}),
+            meta={"csrf": False},
+        )
+
+        assert form.validate()
+        assert form.errors == {}
+
+
+@pytest.mark.parametrize(
+    ("form_data", "invalid_field"),
+    [
+        pytest.param({"password": "secret"}, "username", id="username-required"),
+        pytest.param({"username": "admin"}, "password", id="password-required"),
+    ],
+)
+def test_login_form_requires_credentials(
+    app: Flask, form_data: dict[str, str], invalid_field: str
+) -> None:
+    with app.test_request_context("/login", method="POST"):
+        form = LoginForm(formdata=MultiDict(form_data), meta={"csrf": False})
+
+        assert not form.validate()
+        assert "This field is required." in form.errors[invalid_field]
+
+
+def test_login_form_accepts_credentials(app: Flask) -> None:
+    with app.test_request_context("/login", method="POST"):
+        form = LoginForm(
+            formdata=MultiDict({"username": "admin", "password": "secret"}),
+            meta={"csrf": False},
+        )
+        assert form.validate()
+
+
+def test_admin_action_form_accepts_submission(app: Flask) -> None:
+    with app.test_request_context(method="POST"):
+        form = AdminActionForm(meta={"csrf": False})
+        assert form.validate()
-- 
cgit v1.3.1