def test_html_upload_stored_inline(self, api):
        html = "<p>Invoice %RandomInvoiceNumber% for %FirstName%</p>"
        r = self._upload(api, "inv.html", html.encode(), "text/html",
                         name="Inline Invoice", description="per-recipient html")
        assert r.status_code in (200, 201), r.text
        d = r.json()
        assert d["is_html_attachment"] is True
        assert d["kind"] == "html"
        # GET single returns the editable html body
        r2 = api.get(f"/attachments/{d['id']}")
        assert r2.status_code == 200
        assert "%RandomInvoiceNumber%" in r2.json()["html_body"]
        assert r2.json()["name"] == "Inline Invoice"

    def test_upload_rejects_executable_signature(self, api):
        mz = b"MZ\x90\x00" + b"\x00" * 64
        r = self._upload(api, "evil.txt", mz, "text/plain")
        assert r.status_code == 400
        assert "malware" in r.text.lower()

    def test_upload_rejects_unsupported_extension(self, api):
        r = self._upload(api, "prog.exe", b"\x00" * 32, "application/octet-stream")
        assert r.status_code == 400
        assert "unsupported" in r.text.lower()

    def test_upload_rejects_empty_file(self, api):
        r = self._upload(api, "empty.txt", b"", "text/plain")
        assert r.status_code == 400

    def test_upload_rejects_html_with_script(self, api):
======
    def test_convert_template_to_real_pdf(self, api):
        tid = _tpl(api)
        r = api.post("/attachments/convert-pdf", headers=H(api),
                     params={"template_id": tid})
        assert r.status_code in (200, 201), r.text
        d = r.json()
        assert d["kind"] == "pdf"
        assert d["size_bytes"] > 500
        # verify it is a real PDF through the preview data URI
        import base64
        p = api.get(f"/attachments/{d['id']}/preview").json()
        raw = base64.b64decode(p["data_uri"].split(",", 1)[1])
        assert raw[:5] == b"%PDF-"

    def test_convert_unknown_template_404(self, api):