import { expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { configureStorage, getStore, serveStoredFile, upload } from "../src/index.ts";

function configure() {
  configureStorage(
    { stores: { public: { driver: "local", access: "public", dir: "files" } } },
    mkdtempSync(join(tmpdir(), "wrnexus-upload-")),
  );
}

test("rejects unsafe upload prefixes before writing", async () => {
  configure();
  const form = new FormData();
  form.set("file", new File(["hello"], "hello.txt", { type: "text/plain" }));
  const request = new Request("http://local/upload", { method: "POST", body: form });
  await expect(upload("public", request, { prefix: "../escape" })).rejects.toThrow(
    "unsafe upload prefix",
  );
});

test("public active content is attachment-only and cannot be MIME-sniffed", async () => {
  configure();
  await getStore("public").driver.put(
    "safe/page.html",
    new TextEncoder().encode("<script>x</script>"),
    {
      contentType: "text/html",
    },
  );
  const response = await serveStoredFile("/__wrnexus/uploads/public/safe/page.html");
  expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
  expect(response?.headers.get("content-disposition")).toStartWith("attachment");
});