import path from "path";
import { describe, expect, it } from "vitest";
import { isSafeFilename, resolveUploadPath } from "./paths";

describe("uploads/paths", () => {
  it("rejects dangerous filenames", () => {
    expect(isSafeFilename("../secret")).toBe(false);
    expect(isSafeFilename("a/../b")).toBe(false);
    expect(isSafeFilename("a/b")).toBe(false);
    expect(isSafeFilename("a\\b")).toBe(false);
  });

  it("accepts normal filenames", () => {
    expect(isSafeFilename("file.webp")).toBe(true);
    expect(isSafeFilename("2025-logo_01.png")).toBe(true);
  });

  it("resolves within upload dir", () => {
    process.env.UPLOAD_DIR = path.join(process.cwd(), "uploads_test");
    const p = resolveUploadPath("x.webp");
    expect(p).toContain(path.join("uploads_test", "x.webp"));
  });
});




