import { describe, expect, it } from 'vitest';
import { validateMimeType, checkMagicBytes } from '../../security/upload.js';
describe('validateMimeType', () => {
    it('accepts an allowlisted type', () => {
        expect(validateMimeType('image/png', ['image/png'])).toBe(true);
    });
    it('rejects a non-allowlisted type', () => {
        expect(validateMimeType('text/html', ['image/png'])).toBe(false);
    });
    it('accepts both Set and Array allowlists', () => {
        expect(validateMimeType('image/jpeg', new Set(['image/jpeg']))).toBe(true);
    });
});
describe('checkMagicBytes', () => {
    function buf(bytes) {
        return new Uint8Array(bytes);
    }
    it('accepts a real PNG header for image/png', () => {
        const png = buf([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
        expect(checkMagicBytes(png, 'image/png').valid).toBe(true);
    });
    it('rejects a JPEG buffer claiming to be PNG', () => {
        const jpeg = buf([0xff, 0xd8, 0xff, 0xe0, 0, 0x10, 0x4a, 0x46, 0x49, 0x46]);
        const result = checkMagicBytes(jpeg, 'image/png');
        expect(result.valid).toBe(false);
        expect(result.detectedMimeType).toBe('image/jpeg');
    });
    it('rejects a WAV file claiming to be WebP (both share the RIFF header)', () => {
        const wav = buf([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x41, 0x56, 0x45]);
        const result = checkMagicBytes(wav, 'image/webp');
        expect(result.valid).toBe(false);
        expect(result.detectedMimeType).toBe('audio/wav');
    });
    it('accepts a real WebP buffer for image/webp', () => {
        const webp = buf([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50]);
        expect(checkMagicBytes(webp, 'image/webp').valid).toBe(true);
    });
    it('accepts a full GIF89a header but rejects a "GIF" prefix only', () => {
        const valid = buf([0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0, 0, 0, 0]);
        expect(checkMagicBytes(valid, 'image/gif').valid).toBe(true);
        const fake = buf([0x47, 0x49, 0x46, 0x00, 0x00, 0x00, 0, 0, 0, 0]);
        // Without the full signature we can't detect the type, but we also won't lie.
        const result = checkMagicBytes(fake, 'image/gif');
        expect(result.valid).toBe(true); // unknown signature => accept (mime allowlist already gated this)
    });
    it('detects SVG by inspecting XML content', () => {
        const svg = new TextEncoder().encode('<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg"/>');
        expect(checkMagicBytes(svg, 'image/svg+xml').valid).toBe(true);
    });
    it('detects AVIF using the ftyp brand', () => {
        const avif = buf([0, 0, 0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x61, 0x76, 0x69, 0x66]);
        expect(checkMagicBytes(avif, 'image/avif').valid).toBe(true);
    });
});
//# sourceMappingURL=upload-magic.test.js.map