feat: API contenuti taggati

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/content-api.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import type Database from 'better-sqlite3';
+import { createDb } from '../src/lib/db';
+import { contentSeed } from '../src/data/content-seed';
+import { applyContentUpdate } from '../src/lib/content-update';
+
+let db: Database.Database;
+const textTag = contentSeed.find((e) => e.type === 'text')!.tag;
+const htmlTag = contentSeed.find((e) => e.type === 'html')?.tag;
+beforeEach(() => { db = createDb(':memory:'); });
+
+describe('applyContentUpdate', () => {
+  it('aggiorna value e styles validi', () => {
+    const r = applyContentUpdate(db, textTag, { value: 'Nuovo testo', styles: { size: 'l' } }, 'admin');
+    expect(r).toEqual({ ok: true });
+    const row = db.prepare('SELECT value, styles, updated_by FROM content_blocks WHERE tag = ?').get(textTag) as any;
+    expect(row.value).toBe('Nuovo testo');
+    expect(JSON.parse(row.styles)).toEqual({ size: 'l' });
+    expect(row.updated_by).toBe('admin');
+  });
+
+  it('404 su tag inesistente, 400 su styles fuori whitelist', () => {
+    expect(applyContentUpdate(db, 'no.tag', { value: 'x' }, 'a')).toMatchObject({ ok: false, status: 404 });
+    expect(applyContentUpdate(db, textTag, { styles: { size: 'xxl' } }, 'a')).toMatchObject({ ok: false, status: 400 });
+  });
+
+  it('sanifica i tag html e rifiuta value su tag image', () => {
+    if (htmlTag) {
+      applyContentUpdate(db, htmlTag, { value: 'ciao <script>alert(1)</script><strong>ok</strong>' }, 'a');
+      const row = db.prepare('SELECT value FROM content_blocks WHERE tag = ?').get(htmlTag) as any;
+      expect(row.value).not.toContain('<script>');
+      expect(row.value).toContain('<strong>ok</strong>');
+    }
+    const imgTag = contentSeed.find((e) => e.type === 'image')!.tag;
+    expect(applyContentUpdate(db, imgTag, { value: 'x' }, 'a')).toMatchObject({ ok: false, status: 400 });
+  });
+});