import { describe, expect, it } from 'vitest'
import { sanitizeTsquery } from './sanitize-tsquery'

describe('sanitizeTsquery', () => {
  it('neutralizes tsquery metachars and SQL injection payloads without throwing', () => {
    const metacharInput = '&|!():*<>'
    const injection = "'; DROP TABLE users;--"
    expect(() => sanitizeTsquery(metacharInput)).not.toThrow()
    expect(() => sanitizeTsquery(injection)).not.toThrow()
    expect(sanitizeTsquery(metacharInput)).toBe('')
    expect(sanitizeTsquery(injection)).not.toMatch(/['"|!()]/)
  })

  it('prefix-AND-joins normal tokens', () => {
    expect(sanitizeTsquery('foo bar')).toBe('foo:* & bar:*')
  })

  it('returns empty string for blank input', () => {
    expect(sanitizeTsquery('   ')).toBe('')
    expect(sanitizeTsquery('')).toBe('')
  })
})