#306

frontend/src/pages/materials/MaterialListPage.test.tsx

@@ -126,4 +126,70 @@ describe ('MaterialListPage', () => {
     expect (screen.getByText ('サイズ:')).toBeInTheDocument ()
     expect (screen.getByText ('2.0 KB')).toBeInTheDocument ()
   })
+
+  it ('shows the selected tag scope and tag-specific add links', async () => {
+    api.apiGet.mockResolvedValueOnce ({
+      materials: [
+        buildMaterial ({
+          id:  10,
+          tag: buildTag ({ id: 30, name: '泣き', category: 'material' }),
+        }),
+      ],
+      count:    1,
+      tagScope: {
+        tag:                { id: 20, name: '伊地知ニジカ', category: 'material' },
+        includeDescendants: true,
+      },
+      groups: [
+        {
+          key:         'tag:30',
+          tag:         { id: 30, name: '泣き', category: 'material' },
+          materialIds: [10],
+          count:       1,
+        },
+      ],
+    })
+
+    renderWithProviders (
+        <MaterialListPage/>,
+        { route: '/materials?tag_id=20&include_descendants=1&group_by=parent_tag' },
+    )
+
+    expect (await screen.findByText (
+        (_, element) => element?.textContent === '伊地知ニジカ 配下の素材を表示中',
+    )).toBeInTheDocument ()
+
+    const addLinks = screen.getAllByRole ('link', { name: 'このタグに素材を追加' })
+    expect (addLinks[0]).toHaveAttribute (
+        'href',
+        '/materials/new?tag=%E4%BC%8A%E5%9C%B0%E7%9F%A5%E3%83%8B%E3%82%B8%E3%82%AB'
+        + '&return_to=%2Fmaterials%3Ftag_id%3D20%26include_descendants%3D1%26group_by%3Dparent_tag',
+    )
+    expect (addLinks[1]).toHaveAttribute (
+        'href',
+        '/materials/new?tag=%E6%B3%A3%E3%81%8D'
+        + '&return_to=%2Fmaterials%3Ftag_id%3D20%26include_descendants%3D1%26group_by%3Dparent_tag',
+    )
+    expect (screen.getByRole ('link', { name: 'タグ選択を解除' })).toHaveAttribute (
+        'href',
+        '/materials?material_filter=present',
+    )
+  })
+
+  it ('shows a clear link when tag_id does not resolve to tag_scope', async () => {
+    api.apiGet.mockResolvedValueOnce ({
+      materials: [],
+      count:     0,
+      tagScope:  null,
+      groups:    [],
+    })
+
+    renderWithProviders (<MaterialListPage/>, { route: '/materials?tag_id=999' })
+
+    expect (await screen.findByText ('選択中タグが見つかりません．')).toBeInTheDocument ()
+    expect (screen.getByRole ('link', { name: 'タグ選択を解除' })).toHaveAttribute (
+        'href',
+        '/materials?material_filter=present',
+    )
+  })
 })

frontend/src/pages/materials/MaterialNewPage.test.tsx

@@ -1,5 +1,6 @@
 import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { Route, Routes, useLocation } from 'react-router-dom'
 
 import MaterialNewPage from '@/pages/materials/MaterialNewPage'
 import { renderWithProviders } from '@/test/render'
@@ -17,6 +18,11 @@ const toastApi = vi.hoisted (() => ({
 vi.mock ('@/lib/api', () => api)
 vi.mock ('@/components/ui/use-toast', () => toastApi)
 
+const LocationView = () => {
+  const location = useLocation ()
+  return <div>{location.pathname + location.search}</div>
+}
+
 describe ('MaterialNewPage', () => {
   beforeEach (() => {
     vi.clearAllMocks ()
@@ -69,4 +75,50 @@ describe ('MaterialNewPage', () => {
     expect (await screen.findAllByText ('ファイルまたは URL は必須です．')).toHaveLength (2)
     expect (screen.getAllByRole ('textbox')[1]).toHaveAttribute ('aria-invalid', 'true')
   })
+
+  it ('returns only to safe material URLs after successful creation', async () => {
+    api.apiPost.mockResolvedValueOnce ({})
+
+    renderWithProviders (
+        <Routes>
+          <Route path="/materials/new" element={<MaterialNewPage/>}/>
+          <Route path="/materials" element={<LocationView/>}/>
+        </Routes>,
+        {
+          route:
+              '/materials/new?tag=%E8%99%B9%E5%A4%8F'
+              + '&return_to=%2Fmaterials%3Ftag_id%3D20',
+        },
+    )
+
+    fireEvent.change (screen.getAllByRole ('textbox')[1], {
+      target: { value: 'https://example.com/ref' },
+    })
+    fireEvent.click (screen.getByRole ('button', { name: '追加' }))
+
+    expect (await screen.findByText ('/materials?tag_id=20')).toBeInTheDocument ()
+  })
+
+  it ('ignores unsafe return_to values after successful creation', async () => {
+    api.apiPost.mockResolvedValueOnce ({})
+
+    renderWithProviders (
+        <Routes>
+          <Route path="/materials/new" element={<MaterialNewPage/>}/>
+          <Route path="/materials" element={<LocationView/>}/>
+        </Routes>,
+        {
+          route:
+              '/materials/new?tag=%E8%99%B9%E5%A4%8F'
+              + '&return_to=https%3A%2F%2Fexample.com%2Fevil',
+        },
+    )
+
+    fireEvent.change (screen.getAllByRole ('textbox')[1], {
+      target: { value: 'https://example.com/ref' },
+    })
+    fireEvent.click (screen.getByRole ('button', { name: '追加' }))
+
+    expect (await screen.findByText ('/materials')).toBeInTheDocument ()
+  })
 })