import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import { test } from 'node:test'

function source(relativePath: string) {
  return readFileSync(new URL(`../${relativePath}`, import.meta.url), 'utf8')
}

test('日志不直接输出认证值、请求体或用户文件路径', () => {
  const files = [
    'src/index.ts',
    'src/routes/symbolicate.ts',
    'src/parsers/dsym.ts',
    'src/parsers/flutter.ts',
  ].map(source).join('\n')

  const forbidden = [
    /console\.(?:log|error|warn)\([^)]*apiKey/,
    /console\.(?:log|error|warn)\([^)]*req\.body/,
    /console\.(?:log|error|warn)\([^)]*dsymPath/,
    /console\.(?:log|error|warn)\([^)]*debugSymbolsPath/,
    /console\.(?:log|error|warn)\([^)]*,\s*err\s*[),]/,
  ]

  for (const pattern of forbidden) {
    assert.equal(pattern.test(files), false, `发现不安全日志模式：${pattern}`)
  }
})

test('HTTP 输入和未来文件上传依赖均保持显式上限', () => {
  assert.match(source('src/index.ts'), /DEFAULT_BODY_LIMIT = '105mb'/)

  const packageJson = JSON.parse(source('package.json')) as {
    dependencies: Record<string, string>
  }
  assert.equal(packageJson.dependencies.multer, '2.2.0')
})