import { BadRequestException } from '@nestjs/common';
import { strictValidationPipe } from '../common/strict-validation.pipe';
import { ClientHttpCredentialDto, ClientWebhookDto } from './client-open-api.dto';

function validate<T>(metatype: new () => T, value: unknown) {
  return strictValidationPipe.transform(value, { type: 'body', metatype, data: undefined });
}

describe('client HTTP API DTOs', () => {
  it('rejects client-supplied operator identity and malformed expiry dates', async () => {
    await expect(validate(ClientHttpCredentialDto, { name: '凭据', createdById: 'spoofed' })).rejects.toBeInstanceOf(
      BadRequestException,
    );
    await expect(validate(ClientHttpCredentialDto, { expiresAt: 'tomorrow' })).rejects.toBeInstanceOf(
      BadRequestException,
    );
  });

  it('accepts a blank webhook URL for deletion and rejects unsafe fields', async () => {
    await expect(validate(ClientWebhookDto, { url: '   ' })).resolves.toEqual(expect.objectContaining({ url: '' }));
    await expect(validate(ClientWebhookDto, { url: 'javascript:alert(1)' })).rejects.toBeInstanceOf(
      BadRequestException,
    );
    await expect(
      validate(ClientWebhookDto, { url: 'https://example.com/hook', status: 'approved' }),
    ).rejects.toBeInstanceOf(BadRequestException);
  });
});