package identity

import (
	"strings"
	"testing"
)

func TestWelcomeEmailHTMLIsRichAndEscapesUserValues(t *testing.T) {
	body := welcomeEmailHTML(`<script>alert(1)</script>`, "user@example.com", false, "https://console.example.com")
	if !strings.Contains(body, "identity") && !strings.Contains(body, "欢迎加入清云互联") {
		t.Fatalf("welcome HTML missing expected content: %s", body)
	}
	if strings.Contains(body, "<script>") || !strings.Contains(body, "&lt;script&gt;") {
		t.Fatalf("welcome HTML did not escape username: %s", body)
	}
	if !strings.Contains(body, "https://console.example.com/login") {
		t.Fatalf("welcome HTML missing login URL: %s", body)
	}
}
