test(core-components): cover invalid mustache patterns in prompt template

[Victor-w-Madeira]

Context

Follow-up to #214 (delivered in PR #220), which covered the f-string parser's invalid-pattern rejection contract. This issue tracks the mustache-mode equivalent — the cases originally listed under "mustache mode" in #214 that were deferred to a dedicated PR.

The mustache path is a different branch of the upstream validator (validate_mustache_template in src/lfx/src/lfx/utils/mustache_security.py plus mustache_template_vars from langchain_core.prompts.string), so the rejection contract must be re-asserted independently of #214. The use_double_brackets toggle helper landed in PR #218 (issue #213), so the test prerequisite is met.

Source references (Langflow upstream):

• src/lfx/src/lfx/base/prompts/api_utils.py:127-177 — validate_prompt() branches on is_mustache; the mustache path calls validate_mustache_template() first, then mustache_template_vars().
• src/lfx/src/lfx/utils/mustache_security.py — validate_mustache_template() rejects section/inverted/triple-brace syntax with explicit error messages.

Scope

All tests run with the use_double_brackets toggle flipped ON (mustache mode). Toggle helper available in prompt-template-double-brackets-regression.spec.ts (flipDoubleBrackets(page, true)).

#	Input	Expected behavior
1	{{ var }} (spaces inside braces)	Error toast surfaces; no handle created
2	{{var.attr}} (dot notation)	Error toast surfaces; no handle created
3	{{#section}}{{/section}} (mustache section)	Error toast surfaces with the "Complex mustache syntax is not allowed" message; no handle created
4	{{{var}}} (triple braces / unescaped HTML)	Error toast surfaces; no handle created

Probe each case against POST /api/v1/validate/prompt with \"mustache\": true before writing the spec — the f-string follow-up surfaced two cases ({} and {var-name}) that don't error in practice, and the same risk applies here. Adjust the spec if the live behavior differs from what this issue claims, and document the deviation in the spec doc.

Tags

All tests: @stable @regression @components. None should carry @release — defensive contract tests, not happy-path flows.

Deliverables

• tests/tests-automations/regression/core-components/prompt-template-invalid-mustache-patterns-regression.spec.ts
• docs/core-components/prompt-template-invalid-mustache-patterns-regression.md
• QA-CHECKLIST.md — add bullets under §3.2 covering mustache-mode invalid-pattern rejection
• docs/core-components/prompt-template-invalid-patterns-regression.md — update the "What this test does not cover" section to point at the new spec
• docs/core-components/prompt-template-double-brackets-regression.md — extend "What this test does not cover" with a pointer to the new spec

Out of scope

• F-string mode invalid patterns (covered by test(core-components): cover invalid variable patterns in prompt template #214 / PR test(core-components): cover invalid f-string patterns in prompt template #220)
• The use_double_brackets toggle behavior itself (covered by test(core-components): cover use_double_brackets toggle in prompt template #213 / PR test(core-components): cover use_double_brackets toggle in prompt template #218)
• Tool Mode interaction (covered by tool-mode.spec.ts)

Notes

• The error surface is the same toast (.error-build-message) used by f-string rejection — the i18n title comes from errors.prompt, the detail from error.response.data.detail. Selector strategy in prompt-template-invalid-patterns-regression.spec.ts is directly reusable.
• The toast auto-dismisses after 5 seconds (src/frontend/src/alerts/error/index.tsx:22) — the first toast assertion should use a 5-second timeout.
• Tests should call (page as any).allowFlowErrors() since the validate endpoint deliberately returns HTTP 500 for these cases.