// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第三十三批回归闸门：code2session 不泄露 session_key 且 openid 绑定需会话一致
 */
describe('第三十三批 code2session 加固闸门', () => {
  const rootDir = path.resolve(__dirname, '../../');
  const indexCode = fs.readFileSync(path.join(rootDir, 'server/src/index.ts'), 'utf-8');

  const block = () => {
    const start = indexCode.indexOf("app.post('/api/wechat/code2session'");
    expect(start).toBeGreaterThan(-1);
    return indexCode.slice(start, start + 2600);
  };

  it('不得向客户端返回 session_key', () => {
    const b = block();
    expect(b).not.toContain('sessionKey: session_key');
    expect(b).not.toContain('const { openid, session_key, unionid }');
  });

  it('openid 绑定必须经服务端会话身份', () => {
    const b = block();
    expect(b).toContain("'绑定微信账户'");
    expect(b).toContain('repo.updateUserOpenid(claimed, openid)');
    expect(b).not.toContain('repo.updateUserOpenid(Number(userId), openid)');
  });
});