Quiiz system

tests/api/reactions.py

@@ -124,6 +124,10 @@ _counter_reactions = [0]
 AJAX_reactions = {"X-Requested-With": "fetch"}
 ROCKET = REACTION_EMOJI[2]
 HEART = REACTION_EMOJI[1]
+UNICORN = "\U0001F984"
+SKIN_TONE = "\U0001F44D\U0001F3FF"
+ZWJ_SEQUENCE = "\U0001F9D1\u200d\U0001F4BB"
+FLAG = "\U0001F1F3\U0001F1F1"
 def _session_reactions():
     _counter_reactions[0] += 1
     name = f"rxn{int(time.time() * 1000)}{_counter_reactions[0]}"
@@ -251,12 +255,68 @@ def test_two_distinct_emoji_both_counted(app_server):
     assert set(payload["mine"]) == {ROCKET, HEART}
 
 
-def test_emoji_outside_palette_rejected(app_server):
+def test_emoji_outside_palette_accepted(app_server):
     s, name = _session_reactions()
     post_uid = _make_post_reactions(_uid_reactions(name))
     r = s.post(
         f"{BASE_URL}/reactions/post/{post_uid}",
-        data={"emoji": "notanemoji"},
+        data={"emoji": UNICORN},
+        headers=AJAX_reactions,
+    )
+    payload = r.json()
+    assert payload["counts"][UNICORN] == 1
+    assert payload["mine"] == [UNICORN]
+    assert _live_reaction_count("post", post_uid) == 1
+
+
+def test_composed_emoji_accepted(app_server):
+    s, name = _session_reactions()
+    post_uid = _make_post_reactions(_uid_reactions(name))
+    for value in (SKIN_TONE, ZWJ_SEQUENCE, FLAG):
+        r = s.post(
+            f"{BASE_URL}/reactions/post/{post_uid}",
+            data={"emoji": value},
+            headers=AJAX_reactions,
+        )
+        assert r.json()["counts"][value] == 1
+    assert _live_reaction_count("post", post_uid) == 3
+
+
+def test_off_palette_reaction_toggles_off(app_server):
+    s, name = _session_reactions()
+    post_uid = _make_post_reactions(_uid_reactions(name))
+    for _ in range(2):
+        r = s.post(
+            f"{BASE_URL}/reactions/post/{post_uid}",
+            data={"emoji": UNICORN},
+            headers=AJAX_reactions,
+        )
+    payload = r.json()
+    assert payload["counts"].get(UNICORN, 0) == 0
+    assert payload["mine"] == []
+    assert _live_reaction_count("post", post_uid) == 0
+
+
+def test_non_emoji_rejected(app_server):
+    s, name = _session_reactions()
+    post_uid = _make_post_reactions(_uid_reactions(name))
+    for value in ("notanemoji", "<script>alert(1)</script>", " ", f"{UNICORN} text"):
+        r = s.post(
+            f"{BASE_URL}/reactions/post/{post_uid}",
+            data={"emoji": value},
+            headers=AJAX_reactions,
+            allow_redirects=False,
+        )
+        assert r.status_code == 303, value
+    assert get_table("reactions").count(target_type="post", target_uid=post_uid) == 0
+
+
+def test_multiple_emoji_in_one_reaction_rejected(app_server):
+    s, name = _session_reactions()
+    post_uid = _make_post_reactions(_uid_reactions(name))
+    r = s.post(
+        f"{BASE_URL}/reactions/post/{post_uid}",
+        data={"emoji": UNICORN + ROCKET},
         headers=AJAX_reactions,
         allow_redirects=False,
     )