import {
  describe,
  it,
  expect
} from 'vitest';
import { isAllowedAttachmentStoredPath, resolveAttachmentStoredFilename } from './attachment-storage.util';

describe('attachment-storage.util', () => {
  it('allows attachment paths under server and direct-messages roots', () => {
    const appDataPath = '/home/user/.config/metoyou';

    expect(isAllowedAttachmentStoredPath(`${appDataPath}/server/room-1/image/file.png`, appDataPath)).toBe(true);
    expect(isAllowedAttachmentStoredPath(`${appDataPath}/direct-messages/dm-1/files/file.bin`, appDataPath)).toBe(true);
  });

  it('rejects paths outside attachment roots', () => {
    const appDataPath = '/home/user/.config/metoyou';

    expect(isAllowedAttachmentStoredPath('/etc/passwd', appDataPath)).toBe(false);
    expect(isAllowedAttachmentStoredPath(`${appDataPath}/plugins/evil.js`, appDataPath)).toBe(false);
  });

  it('sanitizes legacy filenames to basename-only storage names', () => {
    expect(resolveAttachmentStoredFilename('legacy', '../../escape.txt')).toBe('legacy.txt');
  });
});
