package tech.easyflow.admin.controller.skill;

import org.testng.Assert;
import org.testng.annotations.Test;
import tech.easyflow.skill.service.SkillCategoryService;

import static org.mockito.Mockito.mock;

/**
 * {@link SkillCategoryController} 查询参数安全契约测试。
 */
public class SkillCategoryControllerContractTest {

    /**
     * 分类排序只接受固定字段和方向，恶意片段应回退到默认排序。
     */
    @Test
    public void categorySortUsesStrictAllowlist() {
        SkillCategoryController controller = new SkillCategoryController(mock(SkillCategoryService.class));

        Assert.assertEquals(controller.resolveOrderBy("categoryName", "desc"),
                "category_name desc, id asc");
        Assert.assertEquals(controller.resolveOrderBy("sort_no desc; drop table tb_skill", null),
                "sort_no asc, id asc");
        Assert.assertEquals(controller.resolveOrderBy("id", "unexpected"), "id asc");
    }

    /**
     * 分类控制器不得继承未加租户范围的通用 list、page 和 detail 入口。
     */
    @Test
    public void categoryControllerDoesNotExposeInheritedCrudQueries() {
        Assert.expectThrows(NoSuchMethodException.class,
                () -> SkillCategoryController.class.getMethod("detail", String.class));
        Assert.assertFalse(java.util.Arrays.stream(SkillCategoryController.class.getMethods())
                .anyMatch(method -> "list".equals(method.getName()) || "page".equals(method.getName())));
    }
}
