Extend local inscription lab with MIME bodies and parent provenance

tests/flow.spec.js

@@ -84,9 +84,9 @@ test('wallet backup reload and rejected oversized or invalid input',async({page}
   const address=await page.locator('#address').inputValue();
   const [download]=await Promise.all([page.waitForEvent('download'),page.getByRole('button',{name:'Save test wallet'}).click()]);
   await page.getByRole('button',{name:'Mine a block'}).click();
-  await page.locator('#payload').fill('🌱'.repeat(71));
+  await page.locator('#payload').fill('🌱'.repeat(4097));
   await page.getByRole('button',{name:'Review inscription'}).click();
-  await expect(page.getByRole('status')).toContainText('at most 280');
+  await expect(page.getByRole('status')).toContainText('at most 16384');
   await expect(page.locator('#pending')).toHaveText('0');
   await page.locator('#load-wallet').setInputFiles({name:'bad.json',mimeType:'application/json',buffer:Buffer.from('{"network":"mainnet"}')});
   await expect(page.getByRole('status')).toContainText('Only Super Testnet');
@@ -121,4 +121,50 @@ test('storage failure leaves the displayed and persisted chain unchanged', async
   await expect(page.locator('#height')).toHaveText('0');
   await page.getByRole('button',{name:'Mine a block'}).click();
   await expect(page.locator('#balance')).toHaveText('50.00000000');
-});
+});
+test('MIME upload, reset only after success, and parent/child navigation', async ({ page }) => {
+  await page.goto('/');
+  await page.locator('#create-wallet').click(); await page.locator('#mine').click();
+  await page.locator('#payload').fill('parent'); await page.locator('#review').click(); await page.locator('#sign').click();
+  await expect(page.locator('#payload')).toHaveValue('');
+  await expect(page.locator('#byte-count')).toHaveText('0 / 16384 bytes');
+  const parent = await page.locator('#parent option').nth(1).getAttribute('value');
+  await page.locator('#parent').selectOption(parent);
+  await page.locator('#body-file').setInputFiles({ name: 'art.svg', mimeType: 'image/svg+xml', buffer: Buffer.from('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><circle cx="10" cy="10" r="8" fill="orange"/></svg>') });
+  await page.locator('#review').click();
+  await expect(page.locator('#review-preview iframe')).toHaveAttribute('sandbox', '');
+  await page.evaluate(() => { window.originalSetItem = Storage.prototype.setItem; Storage.prototype.setItem = () => { throw new Error('quota'); }; });
+  await page.locator('#sign').click();
+  await expect(page.getByRole('status')).toContainText('No changes were saved');
+  await expect(page.locator('#review-panel')).toBeVisible();
+  await expect(page.locator('#parent')).toHaveValue(parent);
+  expect(await page.locator('#body-file').evaluate(e => e.files.length)).toBe(1);
+  await page.evaluate(() => { Storage.prototype.setItem = window.originalSetItem; });
+  await page.locator('#sign').click();
+  await expect(page.locator('.collectible')).toHaveCount(2);
+  await expect(page.locator('#review-panel')).toBeHidden();
+  await expect(page.locator('#parent')).toHaveValue('');
+  await expect(page.locator('#byte-count')).toHaveText('0 / 16384 bytes');
+  expect(await page.locator('#body-file').evaluate(e => e.files.length)).toBe(0);
+  await page.locator('.collectible').getByRole('link', { name: /^Parent / }).click();
+  await expect(page.locator('#inspector pre').first()).toHaveText('parent');
+  await page.locator('#inspector').getByRole('link', { name: /^Child / }).click();
+  await expect(page.locator('#inspector')).toContainText('image/svg+xml');
+  await page.reload();
+  await expect(page.locator('#inspector iframe')).toBeVisible();
+});
+
+test('HTML preview cannot execute, navigate or fetch remote resources', async ({ page }) => {
+  const remote = [];
+  page.on('request', r => { if (/^https?:/.test(r.url()) && !r.url().startsWith('http://127.0.0.1:4178')) remote.push(r.url()); });
+  await page.goto('/'); await page.locator('#create-wallet').click(); await page.locator('#mine').click();
+  await page.locator('#mime-type').selectOption('text/html');
+  await page.locator('#payload').fill('<meta http-equiv="refresh" content="0;url=https://example.com"><script>parent.unwanted=true</script><img src="https://example.com/a"><iframe src="https://example.com"></iframe><p style="background:url(https://example.com/b)" onclick="parent.unwanted=true">safe words</p><a href="https://example.com">link</a>');
+  await page.locator('#review').click();
+  await expect(page.frameLocator('#review-preview iframe').locator('p')).toHaveText('safe words');
+  await page.locator('#sign').click();
+  await expect(page.frameLocator('.collectible iframe').locator('p')).toHaveText('safe words');
+  expect(await page.evaluate(() => window.unwanted)).toBeUndefined();
+  expect(remote).toEqual([]);
+  await expect(page).toHaveURL('http://127.0.0.1:4178/');
+});