'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const { assertReadOnlySql, maskSql } = require('../../src/security/read-only-sql');

test('read-only SQL policy accepts inspection queries and harmless literals', () => {
  assert.equal(assertReadOnlySql('SELECT title FROM games LIMIT 10'), 'SELECT title FROM games LIMIT 10');
  assert.equal(assertReadOnlySql("SELECT 'delete from games' AS example"), "SELECT 'delete from games' AS example");
  assert.equal(assertReadOnlySql('WITH ids AS (SELECT id FROM games) SELECT * FROM ids'), 'WITH ids AS (SELECT id FROM games) SELECT * FROM ids');
  assert.equal(assertReadOnlySql('PRAGMA table_info(games)'), 'PRAGMA table_info(games)');
  assert.match(maskSql("SELECT 'quoted' -- comment\nFROM games"), /^SELECT\s+\s+\s+FROM games$/m);
});

test('read-only SQL policy blocks writable PRAGMAs, DML, stacked statements and extensions', () => {
  const blocked = [
    'PRAGMA user_version = 123',
    'PRAGMA user_version(123)',
    'PRAGMA journal_mode=WAL',
    'PRAGMA optimize',
    'WITH ids AS (SELECT id FROM games) DELETE FROM games',
    'SELECT 1; DROP TABLE games',
    "SELECT load_extension('payload')",
    "SELECT writefile('/tmp/out', 'content')",
  ];
  for (const sql of blocked) assert.throws(() => assertReadOnlySql(sql), undefined, sql);
});