import { describe, it, expect } from 'vitest'
import { buildZip } from '@/lib/exporter/zip'

function u8(s: string): Uint8Array {
  return new TextEncoder().encode(s)
}

describe('buildZip path guard', () => {
  it('rejects dangerous asset paths with .. segments', async () => {
    await expect(
      buildZip({ html: '', css: '', js: '', assets: { '../evil.txt': u8('x') } })
    ).rejects.toThrow(/invalid asset path/i)
  })

  it('rejects dangerous extras with absolute path and backslashes', async () => {
    await expect(
      buildZip({ html: '', css: '', js: '', extras: { '/abs.txt': u8('x') } })
    ).rejects.toThrow(/invalid extra path/i)

    await expect(
      buildZip({ html: '', css: '', js: '', extras: { 'assets\\x.bin': u8('x') } })
    ).rejects.toThrow(/invalid extra path/i)
  })

  it('accepts safe relative paths under assets/', async () => {
    const zip = await buildZip({ html: '', css: '', js: '', assets: { 'assets/a.bin': u8('ok') } })
    expect(zip.byteLength).toBeGreaterThan(0)
  })
})