"use strict";
const test = require("node:test");
const assert = require("node:assert/strict");
const { isSafeFilename } = require("../main.js").__test__;

test("isSafeFilename accepts every filename currently in the vault", () => {
  const real = [
    "Agentic Engineering, explained by a 10x developer.md",
    "Webinar Plan - From Chat Box to Your Own OS.md",
    "Webinar script.md",
    "You're reading way too much code.md",
    "ИИ глупый!.md",
    "Скиллы на базе git — новая память AI-агентов.md",
    "sebastian interview - conclusions and insights.md",
    "In 1 Year, the Gap Between AI Users and Everyone Else Will Be Irreversible.md",
  ];
  for (const name of real) {
    assert.equal(isSafeFilename(name), true, `should accept: ${name}`);
  }
});

test("isSafeFilename rejects shell metacharacters", () => {
  for (const bad of ['a".md', "a`b.md", "a$b.md", "a&b.md", "a|b.md", "a;b.md",
                     "a<b.md", "a>b.md", "a%b.md", "a\nb.md", "a\rb.md"]) {
    assert.equal(isSafeFilename(bad), false, `should reject: ${JSON.stringify(bad)}`);
  }
});

test("isSafeFilename rejects the cmd.exe escape character and control characters", () => {
  // `^` escapes the next character in cmd.exe, so it can defuse the closing
  // quote. NUL additionally makes spawn() throw synchronously.
  for (const bad of ["a^b.md", "a\u0000b.md", "a\u001bb.md", "a\u007fb.md"]) {
    assert.equal(isSafeFilename(bad), false, `should reject: ${JSON.stringify(bad)}`);
  }
});

test("isSafeFilename rejects path traversal", () => {
  assert.equal(isSafeFilename("../secrets.md"), false);
  assert.equal(isSafeFilename("a/../../b.md"), false);
});

test("isSafeFilename rejects empty and non-string input", () => {
  assert.equal(isSafeFilename(""), false);
  assert.equal(isSafeFilename(null), false);
  assert.equal(isSafeFilename(undefined), false);
  assert.equal(isSafeFilename(42), false);
});