import { describe, expect, it } from "vitest";
import { validateUpload } from "@/services/media-service";
import { LocalStorageService } from "@/core/storage/storage";

describe("media upload security", () => {
  it("rejects executable and script uploads", () => {
    expect(
      validateUpload({
        mimeType: "application/javascript",
        size: 100,
        fileName: "payload.js",
      }).ok,
    ).toBe(false);

    expect(
      validateUpload({
        mimeType: "image/png",
        size: 100,
        fileName: "evil.exe",
      }).ok,
    ).toBe(false);
  });

  it("accepts allowed image types within size limits", () => {
    expect(
      validateUpload({
        mimeType: "image/webp",
        size: 1024,
        fileName: "hero.webp",
      }),
    ).toEqual({ ok: true });
  });

  it("enforces tenant ownership on storage keys", async () => {
    const storage = new LocalStorageService();
    const key = storage.buildTenantKey({
      tenantId: "tenant-a",
      projectId: "project-1",
      assetId: "asset-1",
      fileName: "plan.pdf",
    });

    expect(key.startsWith("tenants/tenant-a/")).toBe(true);
    await expect(storage.getSignedUrl(key, "tenant-b")).rejects.toThrow(
      /does not belong/,
    );
  });
});