import 'reflect-metadata';
import { plainToInstance } from 'class-transformer';
import { validateSync } from 'class-validator';
import { PatchActivityItemDto } from '../../modules/booking/dto/patch-activity-item.dto';

const errorsFor = (value: unknown) =>
  validateSync(plainToInstance(PatchActivityItemDto, { ticket_file_url: value })).filter(
    (e) => e.property === 'ticket_file_url',
  );

describe('ticket / document URL validation', () => {
  it.each(['/api/uploads/acme/1712-ab.pdf', 'https://supplier.example/ticket/123', null, ''])(
    'accepts %p',
    (v) => {
      expect(errorsFor(v)).toHaveLength(0);
    },
  );

  it.each([
    'javascript:alert(1)',
    'data:text/html;base64,PHNjcmlwdD4=',
    'http://insecure.example/t.pdf',
    '/api/uploads/../../etc/passwd',
    '/etc/passwd',
  ])('rejects %p', (v) => {
    expect(errorsFor(v).length).toBeGreaterThan(0);
  });
});