import path from 'path';
import { describe, it, expect } from 'vitest';
import { isPathInside } from '../path-security';

const base = path.resolve('C:/data/clone');

describe('TC-PATH · 路径边界判定（§7.3 / H2）', () => {
  it('TC-PATH-01: 目标等于基目录 → 允许', () => {
    expect(isPathInside(base, base)).toBe(true);
  });

  it('TC-PATH-02: 目标在基目录内（含多级）→ 允许', () => {
    expect(isPathInside(base, path.join(base, 'abc'))).toBe(true);
    expect(isPathInside(base, path.join(base, 'a/b/c'))).toBe(true);
  });

  it('TC-PATH-03: 兄弟目录（前缀相似）→ 拒绝（startsWith 绕过回归）', () => {
    expect(isPathInside(base, base + '2')).toBe(false);      // clone2
    expect(isPathInside(base, base + '-evil')).toBe(false);   // clone-evil
  });

  it('TC-PATH-04: 上级目录/绝对越界 → 拒绝', () => {
    expect(isPathInside(base, path.resolve(base, '..'))).toBe(false);
    expect(isPathInside(base, path.resolve(base, '../../x'))).toBe(false);
  });
});