import { describe, it, expect } from 'vitest'
import { sanitizeMasterDataCell } from '../excel-service'

// Note: parseMasterDataExcel requires ExcelJS file parsing (async, DOM-ish buffer).
// We unit-test the pure sanitization helper here; the integration with
// parseMasterDataExcel is covered by the formula-prefix checks embedded there.

describe('sanitizeMasterDataCell (formula injection guard)', () => {
  it('passes through normal strings unchanged', () => {
    expect(sanitizeMasterDataCell('NORMAL_CODE')).toBe('NORMAL_CODE')
    expect(sanitizeMasterDataCell('Bezeichnung Test')).toBe('Bezeichnung Test')
    expect(sanitizeMasterDataCell('')).toBe('')
  })

  it('prefixes = with apostrophe (formula injection)', () => {
    expect(sanitizeMasterDataCell('=HYPERLINK("http://evil.com")')).toBe(
      "'=HYPERLINK(\"http://evil.com\")",
    )
  })

  it('prefixes + with apostrophe', () => {
    expect(sanitizeMasterDataCell('+1')).toBe("'+1")
  })

  it('prefixes - with apostrophe', () => {
    expect(sanitizeMasterDataCell('-SOMETHING')).toBe("'-SOMETHING")
  })

  it('prefixes @ with apostrophe (DDE injection)', () => {
    expect(sanitizeMasterDataCell('@SUM')).toBe("'@SUM")
  })

  it('does not double-escape strings already starting with apostrophe', () => {
    expect(sanitizeMasterDataCell("'safe")).toBe("'safe")
  })

  it('handles numeric strings without mangling', () => {
    expect(sanitizeMasterDataCell('42')).toBe('42')
  })
})