import { describe, expect, it } from "vitest";
import { MemoryStorage } from "@/infra/storage/memory";
import { detectSpreadsheetFormat } from "@/domain/spreadsheet-adapter/file-signature";
import { assertZipSafe } from "@/domain/spreadsheet-adapter/file-signature";

describe("hardening de arquivo", () => {
  it("rejeita path traversal, extensão enganosa e zip anômalo", async () => {
    const storage = new MemoryStorage();
    await expect(storage.put("../segredo", Buffer.from("x"))).rejects.toMatchObject({ code: "PATH_TRAVERSAL" });
    const zip = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
    expect(() => detectSpreadsheetFormat("dados.csv", zip)).toThrow(/CSV/);
    expect(() => detectSpreadsheetFormat("legado.xls", Buffer.from("a,b"))).toThrow(/XLS/);
    const bomb = Buffer.alloc(64);
    bomb.writeUInt32LE(0x04034b50, 0);
    bomb.writeUInt16LE(0, 8);
    bomb.writeUInt32LE(10, 18);
    bomb.writeUInt32LE(400_000_000, 22);
    bomb.writeUInt16LE(1, 26);
    bomb.writeUInt16LE(0, 28);
    bomb.write("a", 30);
    expect(() => assertZipSafe(bomb)).toThrow(/limite seguro|compressão/i);
  });
});