package app

import (
	"encoding/json"
	"strings"
	"testing"
)

func TestUserTypeFilters(t *testing.T) {
	for _, item := range []struct{ kind, expected string }{{"", ""}, {"test", " AND u.is_test=1"}, {"registered", " AND u.is_test=0"}} {
		where, args, err := testUserFilter(item.kind, "")
		if err != nil || where != item.expected || len(args) != 0 {
			t.Fatalf("filter %q: %q %v %v", item.kind, where, args, err)
		}
	}
	if _, _, err := testUserFilter("invalid", ""); err == nil {
		t.Fatal("invalid type accepted")
	}
	if _, _, err := testUserFilter("", strings.Repeat("x", 65)); err == nil {
		t.Fatal("oversized batch accepted")
	}
	batch := "' OR 1=1 --"
	where, args, err := testUserFilter("test", batch)
	if err != nil || strings.Contains(where, batch) || !strings.Contains(where, "u.test_batch=?") || len(args) != 1 || args[0] != batch {
		t.Fatal("batch must be an exact bound SQL value")
	}
}

func TestPublicProfileDoesNotExposeTestMetadata(t *testing.T) {
	data, err := json.Marshal(profileView{})
	if err != nil {
		t.Fatal(err)
	}
	var result map[string]any
	_ = json.Unmarshal(data, &result)
	if _, exists := result["isTest"]; exists {
		t.Fatalf("public profile exposed internal account metadata: %s", data)
	}
}