feat(documents): rebuild project document workbench

backend/internal/logic/documents/handlers_test.go

@@ -0,0 +1,32 @@
+package documents
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"senlinai-agent/backend/internal/models"
+)
+
+func TestSharedPreviewBodySanitizesMarkdownHTMLAndUnsafeLinks(t *testing.T) {
+	body := sharedPreviewBody(SharedDocument{
+		Document: models.SaDocument{Name: "shared.md", Extension: ".md"},
+		Content: &models.SaDocumentContent{
+			Markdown: "# 标题\n\n<script>alert(1)</script>\n\n[危险链接](javascript:alert(2))",
+		},
+	}, "https://example.test/content")
+
+	require.Contains(t, body, "<h1>标题</h1>")
+	require.NotContains(t, strings.ToLower(body), "<script")
+	require.NotContains(t, strings.ToLower(body), "javascript:")
+}
+
+func TestSharedPreviewBodyEmbedsSupportedBlobWithoutDownloadLink(t *testing.T) {
+	body := sharedPreviewBody(SharedDocument{
+		Document: models.SaDocument{Name: "manual.pdf", Extension: ".pdf", MimeType: "application/pdf"},
+		Blob:     &models.SaDocumentBlob{StorageKey: "blob"},
+	}, "https://example.test/content")
+
+	require.Contains(t, body, `<iframe src="https://example.test/content"`)
+	require.NotContains(t, strings.ToLower(body), "download")
+}