// @vitest-environment jsdom
import { describe, expect, it } from "vitest";

import { csvSafe } from "./Export";

describe("csvSafe — CSV/spreadsheet formula-injection neutralization (audit MEDIUM)", () => {
  it("prefixes formula-trigger leading characters with a quote", () => {
    for (const lead of ["=", "+", "-", "@", ";", "\t", "\r"]) {
      expect(csvSafe(lead + "HYPERLINK(\"http://evil\")")).toBe("'" + lead + "HYPERLINK(\"http://evil\")");
    }
  });

  it("neutralizes the classic DDE / exfiltration payloads", () => {
    expect(csvSafe('=cmd|\'/c calc\'!A1')).toBe("'=cmd|'/c calc'!A1");
    expect(csvSafe('@SUM(A1:A9)')).toBe("'@SUM(A1:A9)");
  });

  it("leaves ordinary values untouched", () => {
    expect(csvSafe("june@example.com")).toBe("june@example.com"); // @ not leading
    expect(csvSafe("https://github.com")).toBe("https://github.com");
    expect(csvSafe("correct horse battery staple")).toBe("correct horse battery staple");
    expect(csvSafe("")).toBe("");
  });
});