Add configurable donation options

tests/test_web_donations.py

@@ -0,0 +1,86 @@
+"""Tests for safe, configuration-driven donation methods."""
+
+from cmdforge.web.donations import load_donation_options
+
+
+def _donation_page(tmp_path, monkeypatch, **environment):
+    monkeypatch.setenv("CMDFORGE_REGISTRY_DB", str(tmp_path / "registry.db"))
+    monkeypatch.delenv("CMDFORGE_DONATION_BITCOIN_ADDRESS", raising=False)
+    monkeypatch.delenv("CMDFORGE_DONATION_PAYPAL_URL", raising=False)
+    for name, value in environment.items():
+        monkeypatch.setenv(name, value)
+
+    from cmdforge.web.app import create_web_app
+
+    app = create_web_app()
+    app.config["TESTING"] = True
+    return app.test_client().get("/donate")
+
+
+def test_loads_valid_bitcoin_and_paypal_options():
+    options = load_donation_options(
+        {
+            "CMDFORGE_DONATION_BITCOIN_ADDRESS": "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
+            "CMDFORGE_DONATION_PAYPAL_URL": "https://www.paypal.com/donate/?hosted_button_id=EXAMPLE",
+        }
+    )
+
+    assert options.enabled
+    assert options.bitcoin_address == "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh"
+    assert options.bitcoin_uri.startswith("bitcoin:bc1qxy2")
+    assert "label=CmdForge" in options.bitcoin_uri
+    assert options.paypal_url.startswith("https://www.paypal.com/donate/")
+
+
+def test_accepts_legacy_base58_bitcoin_address():
+    options = load_donation_options(
+        {"CMDFORGE_DONATION_BITCOIN_ADDRESS": "1BoatSLRHtKNngkdXEeobR76b53LETtpyT"}
+    )
+
+    assert options.bitcoin_address == "1BoatSLRHtKNngkdXEeobR76b53LETtpyT"
+
+
+def test_rejects_malformed_or_unsafe_values():
+    options = load_donation_options(
+        {
+            "CMDFORGE_DONATION_BITCOIN_ADDRESS": "not-a-bitcoin-address",
+            "CMDFORGE_DONATION_PAYPAL_URL": "javascript:alert(1)",
+        }
+    )
+
+    assert not options.enabled
+    assert options.bitcoin_address == ""
+    assert options.bitcoin_uri == ""
+    assert options.paypal_url == ""
+
+
+def test_rejects_paypal_lookalike_and_embedded_credentials():
+    assert not load_donation_options(
+        {"CMDFORGE_DONATION_PAYPAL_URL": "https://paypal.com.example.test/donate"}
+    ).enabled
+    assert not load_donation_options(
+        {"CMDFORGE_DONATION_PAYPAL_URL": "https://user:[email protected]/donate"}
+    ).enabled
+
+
+def test_donation_page_renders_configured_methods(tmp_path, monkeypatch):
+    response = _donation_page(
+        tmp_path,
+        monkeypatch,
+        CMDFORGE_DONATION_BITCOIN_ADDRESS="bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
+        CMDFORGE_DONATION_PAYPAL_URL="https://paypal.me/cmdforge",
+    )
+
+    assert response.status_code == 200
+    assert b"Make a Contribution" in response.data
+    assert b"Open Bitcoin Wallet" in response.data
+    assert b"Donate with PayPal" in response.data
+    assert b"https://paypal.me/cmdforge" in response.data
+
+
+def test_donation_page_hides_payment_section_when_unconfigured(tmp_path, monkeypatch):
+    response = _donation_page(tmp_path, monkeypatch)
+
+    assert response.status_code == 200
+    assert b"Make a Contribution" not in response.data
+    assert b"Other Ways to Help" in response.data