import { describe, expect, it } from 'vitest';
import { scoreSubmissionSpam } from '../../forms/spam.js';
function field(overrides) {
    return {
        id: 'f',
        label: 'Label',
        key: 'key',
        type: 'text',
        required: false,
        sortOrder: 0,
        ...overrides,
    };
}
describe('scoreSubmissionSpam', () => {
    it('returns clean when no strategies trigger', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'name' })],
            rawValues: { name: 'Ada' },
        });
        expect(result.status).toBe('clean');
        expect(result.reasons).toHaveLength(0);
    });
    it('flags a populated honeypot regardless of enabled strategies', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'name' }), field({ key: 'website', type: 'honeypot' })],
            rawValues: { name: 'Ada', website: 'http://spam.example' },
        });
        expect(result.status).toBe('spam');
        expect(result.reasons).toContain('honeypot');
    });
    it('ignores an empty honeypot', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'hp', type: 'honeypot' })],
            rawValues: { hp: '' },
        });
        expect(result.status).toBe('clean');
    });
    it('flags submissions faster than the minimum submit time', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'name' })],
            rawValues: { name: 'Ada' },
            settings: { strategies: ['timeToSubmit'], minSubmitSeconds: 3 },
            elapsedMs: 500,
        });
        expect(result.status).toBe('spam');
        expect(result.reasons).toContain('too_fast');
    });
    it('does not flag a normal-speed submission', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'name' })],
            rawValues: { name: 'Ada' },
            settings: { strategies: ['timeToSubmit'], minSubmitSeconds: 3 },
            elapsedMs: 8000,
        });
        expect(result.status).toBe('clean');
    });
    it('blocks emails and domains on the blocklist', () => {
        const byEmail = scoreSubmissionSpam({
            fields: [field({ key: 'email', type: 'email' })],
            rawValues: { email: 'bad@evil.com' },
            settings: { strategies: ['blocklist'], blockedEmails: ['bad@evil.com'] },
            senderEmail: 'bad@evil.com',
        });
        expect(byEmail.reasons).toContain('blocked_email');
        const byDomain = scoreSubmissionSpam({
            fields: [field({ key: 'email', type: 'email' })],
            rawValues: { email: 'x@evil.com' },
            settings: { strategies: ['blocklist'], blockedDomains: ['evil.com'] },
            senderEmail: 'x@evil.com',
        });
        expect(byDomain.reasons).toContain('blocked_domain');
    });
    it('flags blocked keywords in any text value', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'message', type: 'textarea' })],
            rawValues: { message: 'Cheap V1AGRA available now' },
            settings: { strategies: ['keyword'], blockedKeywords: ['viagra'] },
        });
        // case-insensitive substring; 'viagra' won't match 'v1agra', so this stays clean
        expect(result.status).toBe('clean');
        const hit = scoreSubmissionSpam({
            fields: [field({ key: 'message', type: 'textarea' })],
            rawValues: { message: 'Buy cheap loans today' },
            settings: { strategies: ['keyword'], blockedKeywords: ['cheap loans'] },
        });
        expect(hit.reasons).toContain('blocked_keyword');
    });
    it('enforces a domain allowlist against the origin', () => {
        const blocked = scoreSubmissionSpam({
            fields: [field({ key: 'name' })],
            rawValues: { name: 'Ada' },
            settings: { strategies: ['domainAllowlist'], allowedDomains: ['mysite.com'] },
            origin: 'https://evil.example',
        });
        expect(blocked.reasons).toContain('origin_not_allowed');
        const allowed = scoreSubmissionSpam({
            fields: [field({ key: 'name' })],
            rawValues: { name: 'Ada' },
            settings: { strategies: ['domainAllowlist'], allowedDomains: ['mysite.com'] },
            origin: 'https://www.mysite.com',
        });
        expect(allowed.status).toBe('clean');
    });
    it('merges site-wide default strategies with per-form ones', () => {
        const result = scoreSubmissionSpam({
            fields: [field({ key: 'email', type: 'email' })],
            rawValues: { email: 'x@evil.com' },
            defaultStrategies: ['blocklist'],
            settings: { blockedDomains: ['evil.com'] },
            senderEmail: 'x@evil.com',
        });
        expect(result.status).toBe('spam');
    });
});
//# sourceMappingURL=spam.test.js.map