Test Standards: what every app must prove #

<!-- product/features/books.md -->
- [x] AC-books-1: A logged-in user can add a book with a title and author
- [ ] AC-books-2: Adding a book without a title shows "Title can't be blank"

/// AC-books-1 (product/features/books.md)
#[tokio::test]
async fn logged_in_user_can_add_a_book() { … }

comm -23 <(grep -rhoE 'AC-[a-z0-9_-]+-[0-9]+' product/ | sort -u) \
         <(grep -rhoE 'AC-[a-z0-9_-]+-[0-9]+' tests/ src/ web/src/ | sort -u)

#[test]
fn review_policy_truth_table() {
    let (r, b) = (review(1), book(2));              // review by user 1, book owned by user 2
    for (who, id, create, edit, destroy) in [
        ("author",       1, true, true,  true),
        ("book owner",   2, true, false, false),
        ("other reader", 3, true, false, false),
    ] {
        let u = user(id);
        assert_eq!(can_create(&u, &b), create, "{who} create");
        assert_eq!(can_edit(&u, &r), edit, "{who} edit");
        assert_eq!(can_destroy(&u, &r), destroy, "{who} destroy");
    }
}

insta::assert_json_snapshot!(res.json(), { ".id" => "[id]", ".created_at" => "[ts]" });

#[test]
fn every_mounted_route_is_in_the_routes_table() {
    // Every file that calls .route(...): the app router plus the kernel routers it nests.
    let sources = [
        include_str!("../../src/routes.rs"),
        include_str!("../../src/controllers/dev.rs"),
        include_str!("../../src/kernel/mailbox.rs"),
        include_str!("../../src/kernel/jobs/web.rs"),
    ];
    let mounted: Vec<&str> = sources
        .iter()
        .flat_map(|src| src.split(".route(").skip(1))
        .filter_map(|rest| rest.trim_start().strip_prefix('"')?.split('"').next())
        .collect();
    // If this fails the parser went blind (formatting changed); fix the parser, don't lower the bar.
    assert!(mounted.len() >= 20, "parsed the routers: {mounted:?}");
    for path in mounted {
        assert!(ROUTES.iter().any(|r| r.1 == path), "{path} is routed but has no ROUTES row (add it with its Access)");
    }
}

//! Tenant isolation suite (.offrails/guides/test-standards.md §4), generated from `ROUTES`.
use axum::http::StatusCode;
use my_app::{models::{Book, Review, User}, routes::{Access, ROUTES}};
use crate::{factories::*, support::TestApp};

// (1) One record of every tenant-owned model.
struct Tenant { user: User, book: Book, review: Review }

async fn tenant(app: &TestApp, name: &str) -> Tenant {
    let db = app.db();
    let user = create_user_with_email(db, &format!("{name}@example.com")).await;
    let book = create_book_titled(db, &user, &format!("Secret of {name}")).await;
    let review = create_review(db, &book, &user).await;
    Tenant { user, book, review }
}

// (2) (method, route) → status when A uses B's ids, and the AC that says so. Everything else: 404.
const EXPECTED: &[(&str, &str, StatusCode, &str)] = &[
    ("GET", "/books/{id}", StatusCode::OK, "AC-books-4"),
    ("POST", "/books/{id}", StatusCode::FORBIDDEN, "AC-books-5"),
    ("GET", "/books/{id}/edit", StatusCode::FORBIDDEN, "AC-books-5"),
    ("POST", "/books/{id}/delete", StatusCode::FORBIDDEN, "AC-books-5"),
    ("POST", "/reviews/{id}", StatusCode::FORBIDDEN, "AC-reviews-4"),
    ("GET", "/streams/{stream}", StatusCode::OK, "AC-reviews-5"),
    // …one line per shared route
];

// (3) Ids that aren't a tenant's record, and where they're tested instead.
const NOT_TENANT_IDS: &[(&str, &str)] = &[
    ("/passwords/{token}", "a reset token, not a record: accounts_test"),
    ("/socket/sse/{conn}", "a connection id bound to its session: wire_test"),
];

// (4) Whose id each placeholder is. Panics on one it doesn't know.
fn fill(template: &str, t: &Tenant) -> String {
    let path = template
        .replace("{book_id}", &t.book.id.to_string())
        .replace("{stream}", &format!("book:{}", t.book.id));
    let path = if template.starts_with("/books/") {
        path.replace("{id}", &t.book.id.to_string())
    } else if template.starts_with("/reviews/") {
        path.replace("{id}", &t.review.id.to_string())
    } else {
        path
    };
    assert!(
        !path.contains('{'),
        "{template} takes an id this suite doesn't know. Teach `fill` in \
         tests/app/tenancy_test.rs whose record it is, or list it in NOT_TENANT_IDS with a reason."
    );
    path
}

fn in_scope(template: &str, access: Access) -> bool {
    access == Access::User
        && template.contains('{')
        && !NOT_TENANT_IDS.iter().any(|(t, _)| *t == template)
}

// (5) A request that would succeed if it were allowed.
async fn call(app: &TestApp, method: &str, template: &str, path: &str) -> StatusCode {
    match (method, template) {
        ("GET", t) if t.starts_with("/streams/") => app.open_stream(path).await.0, // endless body
        ("GET", _) => app.get(path).await.status,
        ("POST", "/books/{id}") => {
            let fields = [("title", "Taken"), ("author", "Mallory")];
            app.post_multipart(path, &fields, &[]).await.status
        }
        ("POST", _) => {
            let fields = [("title", "Taken"), ("body", "Mine now"), ("stars", "1")];
            app.post_form(path, &fields).await.status
        }
        (m, _) => panic!("{m} {template}: teach `call` this method"),
    }
}

#[tokio::test]
async fn another_tenants_ids_answer_404_or_their_specd_status_on_every_route() {
    let app = TestApp::new().await;
    let a = tenant(&app, "alice").await;
    let b = tenant(&app, "bob").await;
    app.login_as(&a.user).await;
    let mut checked = 0;
    for (method, template, handler, access) in ROUTES {
        if !in_scope(template, *access) {
            continue;
        }
        let (want, why) = EXPECTED
            .iter()
            .find(|(m, t, _, _)| m == method && t == template)
            .map(|(_, _, s, why)| (*s, *why))
            .unwrap_or((StatusCode::NOT_FOUND, "B's records don't exist for A"));
        let got = call(&app, method, template, &fill(template, &b)).await;
        assert_eq!(got, want, "{method} {template} ({handler}) with another tenant's ids answered \
            {got}, want {want} ({why}). Look records up with `<model>::find_for(db, &user, id)`.");
        checked += 1;
    }
    assert!(checked >= 10, "only {checked} routes were checked; is ROUTES complete?"); // ~80% of id routes
    // Nothing of B's changed.
    assert_eq!(reload_book(app.db(), b.book.id).await, b.book);
    assert_eq!(reload_review(app.db(), b.review.id).await, b.review);
}

#[tokio::test]
async fn every_expected_entry_is_a_real_route() {
    for (method, template, _, why) in EXPECTED {
        assert!(ROUTES.iter().any(|(m, t, _, a)| m == method && t == template && in_scope(t, *a)),
            "EXPECTED lists {method} {template} ({why}), which is not an in-scope route");
    }
    for (template, why) in NOT_TENANT_IDS {
        assert!(ROUTES.iter().any(|(_, t, _, _)| t == template),
            "NOT_TENANT_IDS lists {template} ({why}), which is not a route");
    }
}

#[tokio::test]
async fn own_ids_work_so_the_404s_are_not_a_blanket() {
    let app = TestApp::new().await;
    let a = tenant(&app, "alice").await;
    app.login_as(&a.user).await;
    for (method, template, _, access) in ROUTES {
        if *method == "GET" && in_scope(template, *access) {
            let got = call(&app, method, template, &fill(template, &a)).await;
            assert!(got.is_success() || got.is_redirection(), "GET {template} with A's own ids answered {got}");
        }
    }
}

//! Tenancy guard (.offrails/guides/models.md#scoped-lookups-tenancy). Generated by `new`; keep it.
//!
//! Handlers reach data only through actor-scoped model functions (`find_for(db, &user, id)`).
//! The compiler stops most unscoped calls (raw `find`/`destroy` are `pub(in crate::models)`);
//! this test catches the rest by reading the handler sources. A line that is unscoped on
//! purpose ends with `// unscoped: <AC id or reason>`.

use std::{fs, path::Path};

/// Where request handlers live. Missing directories are skipped.
const HANDLER_DIRS: &[&str] = &["src/controllers", "src/channels", "src/graphql", "src/api"];

/// (pattern, what to do instead)
const FORBIDDEN: &[(&str, &str)] = &[
    (
        "RequireUser(_",
        "the handler requires a user and then ignores it: scope the query with it",
    ),
    (
        "ApiUser(_",
        "the handler ignores the token's user: scope the query with it",
    ),
    (
        "::find(",
        "look records up with `<model>::find_for(db, &user, id)`",
    ),
    (
        "::destroy(",
        "delete with `<model>::destroy_for(db, &user, record)`",
    ),
    ("::all(", "list with `<model>::all_for(db, &user, …)`"),
    (
        "::find_system(",
        "`find_system` is for jobs and tasks; a handler has an actor",
    ),
    (
        "Entity::find",
        "query through the model's scoped functions, not the entity",
    ),
];

const MARKER: &str = "// unscoped:";

fn rust_files(dir: &Path, out: &mut Vec<std::path::PathBuf>) {
    let Ok(entries) = fs::read_dir(dir) else {
        return;
    };
    for entry in entries.flatten() {
        let path = entry.path();
        if path.is_dir() {
            rust_files(&path, out);
        } else if path.extension().is_some_and(|e| e == "rs") {
            out.push(path);
        }
    }
}

#[test]
fn handlers_only_use_scoped_lookups() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR"));
    let mut files = Vec::new();
    for dir in HANDLER_DIRS {
        rust_files(&root.join(dir), &mut files);
    }
    assert!(
        !files.is_empty(),
        "no handler sources found under {HANDLER_DIRS:?}"
    );
    let mut hits = Vec::new();
    for file in &files {
        let src = fs::read_to_string(file).expect("read source");
        for (n, line) in src.lines().enumerate() {
            let code = line.trim_start();
            if code.starts_with("//") || line.contains(MARKER) {
                continue;
            }
            for (pattern, fix) in FORBIDDEN {
                if line.contains(pattern) {
                    let rel = file.strip_prefix(root).unwrap_or(file).display();
                    hits.push(format!("{rel}:{}: `{pattern}`: {fix}", n + 1));
                }
            }
        }
    }
    assert!(
        hits.is_empty(),
        "unscoped data access in handlers (end the line with `{MARKER} <AC id or reason>` \
         only when the spec makes it public):\n{}",
        hits.join("\n")
    );
}

#[test]
fn every_unscoped_marker_gives_a_reason() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR"));
    let mut files = Vec::new();
    for dir in HANDLER_DIRS {
        rust_files(&root.join(dir), &mut files);
    }
    for file in &files {
        let src = fs::read_to_string(file).expect("read source");
        for (n, line) in src.lines().enumerate() {
            if let Some((_, reason)) = line.split_once(MARKER) {
                assert!(
                    reason.trim().len() >= 8,
                    "{}:{}: `{MARKER}` needs a reason (an AC id or why the data is public)",
                    file.display(),
                    n + 1
                );
            }
        }
    }
}

# Test report (2026-10-12, a1b2c3d)

| Suite | SQLite | Postgres |
|-------|--------|----------|
| Rust (212 tests) | ✅ | ✅ |
| Frontend (48) | ✅ | n/a |
| E2E (5) | ✅ | n/a |

Coverage: 86% (models 94%, policies 100%) · Mutants: 0 surviving (policies)

| Feature | Criteria | Proven |
|---------|----------|--------|
| books.md | 7 | 7 ✅ |
| reviews.md | 5 | 4 ⚠️ AC-reviews-5 untested |

import { defineConfig } from "@playwright/test";
const PORT = 3018;                                   // its own port; never one the human uses
export default defineConfig({
  testDir: ".", retries: 0, workers: 1, timeout: 60_000,
  use: { baseURL: `http://localhost:${PORT}`, channel: "chrome", headless: true, trace: "retain-on-failure" },
  webServer: {
    command: "rm -f storage/e2e.sqlite3* && cargo run -q -- db migrate && cargo run -q -- serve",
    cwd: "../..", url: `http://localhost:${PORT}/up`, timeout: 300_000, reuseExistingServer: false,
    env: { APP_ENV: "development", PORT: String(PORT), APP_URL: `http://localhost:${PORT}`,
           DATABASE_URL: "sqlite://storage/e2e.sqlite3?mode=rwc", STORAGE_PATH: "storage/e2e-files", RUST_LOG: "warn" },
  },
});

import AxeBuilder from "@axe-core/playwright";
const ROUTES = ["/", "/start", "/books", "/books/1"];          // every public route, plus logged-in ones with a fixture user
for (const scheme of ["light", "dark"] as const)
  for (const width of [1280, 390])
    for (const route of ROUTES)
      test(`a11y ${route} ${scheme} ${width}`, async ({ page }) => {
        await page.emulateMedia({ colorScheme: scheme, reducedMotion: "reduce" });
        await page.setViewportSize({ width, height: 900 });
        // If the app has a theme toggle stored in a cookie, also set it, so the toggle's paths are covered too
        await page.goto(route);
        const r = await new AxeBuilder({ page })
          .withTags(["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"]).analyze();
        expect(r.violations, JSON.stringify(r.violations.map(v => [v.id, v.nodes.length]))).toEqual([]);
      });

//! What the templates ask of the CSS. Tailwind only emits the classes it saw when it last ran, so
//! a template edited while no watcher ran renders with silently missing styles (a `dark:` partner
//! that does nothing). Used by the theme guard tests, `/dev/introspect.json` and the development
//! CSS banner. Spec: .offrails/guides/views.md#dark-mode, test-standards.md#11-theme-and-css-guards

use std::{
    fs,
    path::{Path, PathBuf},
};

/// Rendered with static/app.css. Kernel pages and mailers carry their own styles.
pub const TEMPLATES: &str = "templates";
pub const SKIP_DIRS: &[&str] = &["templates/kernel", "templates/mailers"];
/// The component layer: `@apply` lists follow the same color rules as class attributes.
pub const CSS_SOURCE: &str = "assets/app.css";
pub const CSS_BUILT: &str = "static/app.css";
/// Classes that are hooks for JS, htmx or tests, never styles. Each needs its reason.
pub const HOOK_CLASSES: &[(&str, &str)] = &[
    // ("errors", "the error summary's hook in tests"),
];

/// Template classes with no selector in the built CSS, as "file:line: class".
/// `None` when the CSS isn't built (nothing to compare).
pub fn missing_classes() -> Option<Vec<String>> {
    let css = fs::read_to_string(CSS_BUILT).ok()?;
    let mut missing = Vec::new();
    for (at, tokens) in class_lists(false) {
        for token in tokens {
            if !HOOK_CLASSES.iter().any(|(c, _)| *c == token) && !has_selector(&css, &token) {
                missing.push(format!("{at}: {token}"));
            }
        }
    }
    Some(missing)
}

/// Tailwind's selector for a class: `CSS.escape` rules (`md:w-1/2` → `md\:w-1\/2`, `2xl:` → `\32 xl\:`).
pub fn css_escape(class: &str) -> String {
    let mut out = String::new();
    for (i, c) in class.chars().enumerate() {
        if i == 0 && c.is_ascii_digit() {
            out.push_str(&format!("\\3{c} "));
        } else if c.is_ascii_alphanumeric() || c == '-' || c == '_' {
            out.push(c);
        } else {
            out.push('\\');
            out.push(c);
        }
    }
    out
}

/// `.class` followed by something that ends the identifier (`.p-4` doesn't count for `.p-40`).
pub fn has_selector(css: &str, class: &str) -> bool {
    let selector = format!(".{}", css_escape(class));
    css.match_indices(&selector).any(|(i, m)| {
        css[i + m.len()..]
            .chars()
            .next()
            .is_none_or(|c| !(c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '\\')))
    })
}

/// Every `class="…"` in the templates (and, with `with_apply`, every `@apply …;` in the CSS
/// source) as ("file:line", tokens). Askama tags inside an attribute are dropped, so both
/// branches of an `{% if %}` form one list.
pub fn class_lists(with_apply: bool) -> Vec<(String, Vec<String>)> {
    let mut files = Vec::new();
    html_files(Path::new(TEMPLATES), &mut files);
    files.sort();
    let mut out = Vec::new();
    for file in files {
        let Ok(src) = fs::read_to_string(&file) else {
            continue;
        };
        let mut offset = 0;
        while let Some(i) = src[offset..].find("class=\"") {
            let start = offset + i + 7;
            let value = attribute_value(&src[start..]);
            let line = src[..start].lines().count().max(1);
            out.push((
                format!("{}:{line}", file.display()),
                tokens(&strip_askama(value)),
            ));
            offset = start + value.len();
        }
    }
    if with_apply && let Ok(css) = fs::read_to_string(CSS_SOURCE) {
        for (n, line) in css.lines().enumerate() {
            if let Some(i) = line.find("@apply ") {
                let list = line[i + 7..].split(';').next().unwrap_or("");
                out.push((format!("{CSS_SOURCE}:{}", n + 1), tokens(list)));
            }
        }
    }
    out
}

fn html_files(dir: &Path, out: &mut Vec<PathBuf>) {
    let Ok(entries) = fs::read_dir(dir) else {
        return;
    };
    for entry in entries.flatten() {
        let path = entry.path();
        if SKIP_DIRS.iter().any(|s| path.starts_with(s)) {
            continue;
        }
        if path.is_dir() {
            html_files(&path, out);
        } else if path.extension().is_some_and(|e| e == "html") {
            out.push(path);
        }
    }
}

/// The attribute value up to its closing quote, skipping quotes inside `{{ }}` / `{% %}`.
fn attribute_value(s: &str) -> &str {
    let bytes = s.as_bytes();
    let mut depth = 0;
    let mut i = 0;
    while i < bytes.len() {
        match (bytes[i], bytes.get(i + 1)) {
            (b'{', Some(b'{' | b'%')) => (depth, i) = (depth + 1, i + 1),
            (b'}' | b'%', Some(b'}')) if depth > 0 => (depth, i) = (depth - 1, i + 1),
            (b'"', _) if depth == 0 => return &s[..i],
            _ => {}
        }
        i += 1;
    }
    s
}

/// Drops `{{ … }}`, `{% … %}` and `{# … #}`, keeping the text between them.
pub fn strip_askama(s: &str) -> String {
    let mut out = String::new();
    let mut rest = s;
    while let Some(i) = rest.find('{') {
        let open = &rest[i..];
        let close = match open.as_bytes().get(1) {
            Some(b'{') => "}}",
            Some(b'%') => "%}",
            Some(b'#') => "#}",
            _ => {
                out.push_str(&rest[..=i]);
                rest = &rest[i + 1..];
                continue;
            }
        };
        out.push_str(&rest[..i]);
        out.push(' ');
        rest = open.find(close).map_or("", |j| &open[j + 2..]);
    }
    out.push_str(rest);
    out
}

fn tokens(list: &str) -> Vec<String> {
    list.split_whitespace().map(str::to_owned).collect()
}

//! Theme and CSS guards (.offrails/guides/test-standards.md#11-theme-and-css-guards). Generated by `new`; keep it.
//!
//! 1. Both color schemes: the layout's body turns dark with the OS, so every light surface, dark
//!    text and faint tone in a template needs its `dark:` partner, or it renders unreadable
//!    (a `bg-white` card with light text: 1.09:1). axe in both schemes finds it per page; this finds
//!    it in every template, including the ones no smoke visits.
//! 2. Stale CSS: every class a template uses has its selector in the built `static/app.css`
//!    (Tailwind only emits classes it saw when it last ran). Skipped when the CSS isn't built.

use <crate>::kernel::css::{
    CSS_BUILT, CSS_SOURCE, class_lists, css_escape, has_selector, missing_classes, strip_askama,
};

const GRAYS: &[&str] = &["slate", "gray", "zinc", "neutral", "stone"];

#[test]
fn templates_pair_every_light_tone_with_a_dark_partner() {
    let mut problems = Vec::new();
    for (at, tokens) in class_lists(true) {
        let fixed_surface = tokens.iter().any(|t| is_fixed_surface(t))
            && !tokens.iter().any(|t| t.starts_with("dark:bg-"));
        for token in &tokens {
            let (variants, utility) = split_variants(token);
            if variants.contains("dark:") {
                continue;
            }
            let has = |what: &str| {
                let partner = format!("dark:{variants}{what}");
                tokens.iter().any(|t| t.starts_with(&partner))
            };
            if is_light_surface(utility) && !has("bg-") {
                problems.push(format!(
                    "{at}: `{token}` needs a `dark:{variants}bg-*` partner (rule a: a light surface stays light while the body turns dark)"
                ));
            }
            if fixed_surface {
                continue; // its own mid/dark background in both schemes: text on it doesn't flip
            }
            if is_dark_text(utility) && !has("text-") {
                problems.push(format!(
                    "{at}: `{token}` needs a `dark:{variants}text-*` partner (rule b: dark text on a surface that turns dark)"
                ));
            } else if is_faint_text(utility) && !has("text-") {
                problems.push(format!(
                    "{at}: `{token}` needs a `dark:{variants}text-*` partner (rule c: a faint tone fails contrast on a dark surface)"
                ));
            }
        }
    }
    assert!(
        problems.is_empty(),
        "colors that break one scheme (palette: .offrails/guides/views.md#dark-mode):\n{}",
        problems.join("\n")
    );
}

#[test]
fn built_css_has_every_class_the_templates_use() {
    let Some(missing) = missing_classes() else {
        eprintln!(
            "skipped: {CSS_BUILT} isn't built (bin/tailwindcss -i {CSS_SOURCE} -o {CSS_BUILT})"
        );
        return;
    };
    assert!(
        missing.is_empty(),
        "classes with no rule in {CSS_BUILT}: delete dead classes from the template, rebuild the CSS \
         (bin/dev runs `bin/tailwindcss --watch`), or list a JS/test hook in kernel::css::HOOK_CLASSES \
         with its reason:\n{}",
        missing.join("\n")
    );
}

// --- the rules ---------------------------------------------------------------------------------

/// `hover:dark:bg-x` → ("hover:dark:", "bg-x"); a leading `!` (important) is dropped.
fn split_variants(token: &str) -> (&str, &str) {
    let cut = token.rfind(':').map_or(0, |i| i + 1);
    (&token[..cut], token[cut..].trim_start_matches('!'))
}

/// `bg-red-50/80` → ("red", 50) for prefix "bg-".
fn color_shade<'a>(utility: &'a str, prefix: &str) -> Option<(&'a str, u32)> {
    let rest = utility.strip_prefix(prefix)?;
    let rest = rest.split('/').next()?;
    let (color, shade) = rest.rsplit_once('-')?;
    Some((color, shade.parse().ok()?))
}

fn is_light_surface(u: &str) -> bool {
    u == "bg-white" || color_shade(u, "bg-").is_some_and(|(_, s)| s <= 200)
}

/// A background that is mid or dark in both schemes (a badge, a primary button).
fn is_fixed_surface(token: &str) -> bool {
    let (variants, u) = split_variants(token);
    variants.is_empty() && (u == "bg-black" || color_shade(u, "bg-").is_some_and(|(_, s)| s >= 300))
}

fn is_dark_text(u: &str) -> bool {
    u == "text-black" || color_shade(u, "text-").is_some_and(|(_, s)| s >= 700)
}

fn is_faint_text(u: &str) -> bool {
    color_shade(u, "text-").is_some_and(|(c, s)| {
        if GRAYS.contains(&c) {
            (400..=600).contains(&s)
        } else {
            (500..=600).contains(&s)
        }
    })
}

#[test]
fn the_guards_themselves() {
    assert!(is_light_surface("bg-white") && is_light_surface("bg-amber-50"));
    assert!(!is_light_surface("bg-indigo-600") && !is_light_surface("bg-white/0x"));
    assert!(is_dark_text("text-gray-900") && is_dark_text("text-red-800"));
    assert!(is_faint_text("text-slate-500") && is_faint_text("text-red-600"));
    assert!(!is_faint_text("text-gray-300") && !is_faint_text("text-white"));
    assert_eq!(split_variants("dark:hover:bg-x"), ("dark:hover:", "bg-x"));
    assert_eq!(css_escape("md:w-1/2"), "md\\:w-1\\/2");
    assert_eq!(css_escape("2xl:p-4"), "\\32 xl\\:p-4");
    assert!(has_selector(".p-4{x}.p-40{y}", "p-4") && !has_selector(".p-40{y}", "p-4"));
    assert_eq!(
        strip_askama("a {% if x %}b{% else %}c{% endif %} {{ d }}")
            .split_whitespace()
            .collect::<Vec<_>>(),
        ["a", "b", "c"]
    );
}