Merge e319e4a0d3 into 2f88a4a315

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

src/server/generate_form.py

@@ -38,8 +38,13 @@ def latest_menu() -> dict:
 
 
 def _json_for_script(value) -> str:
-    """Serialize for embedding in a <script> tag; escape </ to avoid early close."""
-    return json.dumps(value, separators=(",", ":")).replace("</", "<\\/")
+    """Serialize for embedding in a <script> tag; escape < and JS line separators."""
+    return (
+        json.dumps(value, separators=(",", ":"))
+        .replace("<", "\\u003c")
+        .replace("\u2028", "\\u2028")
+        .replace("\u2029", "\\u2029")
+    )
 
 
 def generate_form(

src/server/templates/admin.js

@@ -1,4 +1,5 @@
 /* ADMIN_JS_MARKER */
+(() => {
 const ADMIN_URL = window.ADMIN_URL;
 const ADMIN_PDF_URL = window.ADMIN_PDF_URL;
 const MEALS = window.MEALS;
@@ -444,3 +445,4 @@ function adminInit() {
 }
 
 adminInit();
+})();

tests/test_generate_form.py

@@ -259,6 +259,9 @@ class TestGenerateFormPlaywright:
             yield page
             browser.close()
 
+    def test_admin_bundle_loads(self, browser_page):
+        assert browser_page.evaluate("typeof window.loadWeekOrders") == "function"
+
     def test_qty_plus_updates_total_without_list_teardown(self, browser_page):
         page = browser_page
         card = page.locator('[data-meal-index="0"]')