package service

import (
	"strings"
	"testing"

	"github.com/freefire/jiang13-bbs/model"
)

func TestAdminUserOrderSQLDefault(t *testing.T) {
	got := adminUserOrderSQL("", "")
	if got != "users.id DESC" {
		t.Fatalf("默认排序应为 id DESC，得到 %q", got)
	}
	if adminUserOrderSQL("unknown", "drop table") != "users.id DESC" {
		t.Fatalf("非法 sort/dir 必须回落到 id DESC")
	}
}

func TestAdminUserOrderSQLWhitelist(t *testing.T) {
	cases := []struct {
		sort, dir, wantSub string
		asc                bool
	}{
		{"id", "asc", "users.id ASC", true},
		{"points", "desc", "users.points DESC, users.id DESC", false},
		{"status", "ASC", "users.banned ASC, users.id DESC", true},
		{"created_at", "", "users.created_at DESC, users.id DESC", false},
		{"online", "asc", "users.last_seen_at ASC NULLS LAST", true},
		{"last_login", "desc", "FROM login_logs", false},
		{"role", "asc", "WHEN 'owner' THEN 100", true},
		{"counts", "desc", "posts.status = '" + model.ContentStatusPublished + "'", false},
	}
	for _, tc := range cases {
		got := adminUserOrderSQL(tc.sort, tc.dir)
		if !strings.Contains(got, tc.wantSub) {
			t.Fatalf("sort=%s dir=%s 应包含 %q，得到 %q", tc.sort, tc.dir, tc.wantSub, got)
		}
		if strings.ContainsAny(tc.sort+tc.dir, ";") {
			t.Fatalf("用例本身不应含注入字符")
		}
		if tc.asc && !strings.Contains(got, "ASC") {
			t.Fatalf("sort=%s 应为 ASC：%q", tc.sort, got)
		}
	}
}