const test = require('node:test');
const assert = require('node:assert/strict');
const { validateFileUpload } = require('../src/security/fileUpload');

test('file upload accepts content that matches MIME and extension', () => {
  const buffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
  assert.doesNotThrow(() => validateFileUpload({ mimetype: 'image/png', buffer }, 'avatar.png'));
});

test('file upload rejects mismatched and executable files', () => {
  assert.throws(() => validateFileUpload({ mimetype: 'image/png', buffer: Buffer.from('not an image') }, 'avatar.png'), { code: 415 });
  assert.throws(() => validateFileUpload({ mimetype: 'application/octet-stream', buffer: Buffer.from('MZ') }, 'payload.exe'), { code: 415 });
});