Initial multi-tenant blog host

Go + Postgres application serving a management dashboard on the base
domain and one public blog per subdomain. Markdown posts organised in
pages, form-based theme customisation, image uploads stored in Postgres,
JWT cookie sessions with CSRF, superadmin user management, RSS feeds.
Docker/compose deployment and a Makefile-driven dev environment with
seed data.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 29 insertions, 0 deletions

diff --git a/internal/markdown/render_test.go b/internal/markdown/render_test.go
new file mode 100644
index 0000000..7240afc
--- /dev/null
+++ b/internal/markdown/render_test.go
@@ -0,0 +1,29 @@
+package markdown
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRenderSanitizes(t *testing.T) {
+	out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\">")
+	for _, bad := range []string{"<script", "javascript:", "onerror"} {
+		if strings.Contains(out, bad) {
+			t.Errorf("output contains %q: %s", bad, out)
+		}
+	}
+	for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`} {
+		if !strings.Contains(out, good) {
+			t.Errorf("output missing %q: %s", good, out)
+		}
+	}
+}
+
+func TestRenderGFM(t *testing.T) {
+	out := Render("| a | b |\n|---|---|\n| 1 | 2 |\n\nline one\nline two\n\nhttps://example.org")
+	for _, want := range []string{"<table>", "<br>", `<a href="https://example.org"`} {
+		if !strings.Contains(out, want) {
+			t.Errorf("output missing %q: %s", want, out)
+		}
+	}
+}