import 'reflect-metadata';
import {
	closeTestingConnections,
	createTestingConnections,
	reloadTestingDatabases,
} from '../../utils/test-utils';
import { DataSource } from '../../../src';
import { Post } from './entity/Post';
import { expect } from 'chai';
import { EntityPropertyNotFoundError } from '../../../src/error/EntityPropertyNotFoundError';

describe('other issues > preventing-injection', () => {
	let connections: DataSource[];
	before(
		async () =>
			(connections = await createTestingConnections({
				entities: [__dirname + '/entity/*{.js,.ts}'],
			})),
	);
	beforeEach(() => reloadTestingDatabases(connections));
	after(() => closeTestingConnections(connections));

	it('should not allow selection of non-exist columns via FindOptions', () =>
		Promise.all(
			connections.map(async function (connection) {
				const post = new Post();
				post.title = 'hello';
				await connection.manager.save(post);

				const postWithOnlyIdSelected = await connection.manager.find(Post, {
					select: { id: true },
				});
				postWithOnlyIdSelected.should.be.eql([{ id: 1 }]);

				await connection.manager.find(Post, {
					select: '(WHERE LIMIT 1)' as any,
				}).should.be.rejected;
			}),
		));

	it('should throw error for non-exist columns in where expression via FindOptions', () =>
		Promise.all(
			connections.map(async function (connection) {
				const post = new Post();
				post.title = 'hello';
				await connection.manager.save(post);

				const postWithOnlyIdSelected = await connection.manager.find(Post, {
					where: {
						title: 'hello',
					},
				});
				postWithOnlyIdSelected.should.be.eql([{ id: 1, title: 'hello' }]);

				let error: Error | undefined;
				try {
					await connection.manager.find(Post, {
						where: {
							id: 2,
							['(WHERE LIMIT 1)']: 'hello',
						} as any,
					});
				} catch (err) {
					error = err;
				}
				expect(error).to.be.an.instanceof(EntityPropertyNotFoundError);
			}),
		));

	it('should not allow selection of non-exist columns via FindOptions', () =>
		Promise.all(
			connections.map(async function (connection) {
				const post = new Post();
				post.title = 'hello';
				await connection.manager.save(post);

				const loadedPosts = await connection.manager.find(Post, {
					order: {
						title: 'DESC',
					},
				});
				loadedPosts.should.be.eql([{ id: 1, title: 'hello' }]);

				await connection.manager.find(Post, {
					order: {
						['(WHERE LIMIT 1)' as any]: 'DESC',
					},
				}).should.be.rejected;
			}),
		));

	it('should not allow non-numeric values in skip and take via FindOptions', () =>
		Promise.all(
			connections.map(async function (connection) {
				await connection.manager.find(Post, {
					take: '(WHERE XXX)' as any,
				}).should.be.rejected;

				await connection.manager.find(Post, {
					skip: '(WHERE LIMIT 1)' as any,
					take: '(WHERE XXX)' as any,
				}).should.be.rejected;
			}),
		));

	it('should not allow non-numeric values in skip and take in QueryBuilder', () =>
		Promise.all(
			connections.map(async function (connection) {
				expect(() => {
					connection.manager.createQueryBuilder(Post, 'post').take('(WHERE XXX)' as any);
				}).to.throw(Error);

				expect(() => {
					connection.manager.createQueryBuilder(Post, 'post').skip('(WHERE LIMIT 1)' as any);
				}).to.throw(Error);
			}),
		));

	it('should not allow non-allowed values in order by in QueryBuilder', () =>
		Promise.all(
			connections.map(async function (connection) {
				expect(() => {
					connection.manager.createQueryBuilder(Post, 'post').orderBy('post.id', 'MIX' as any);
				}).to.throw(Error);

				expect(() => {
					connection.manager
						.createQueryBuilder(Post, 'post')
						.orderBy('post.id', 'DESC', 'SOMETHING LAST' as any);
				}).to.throw(Error);
			}),
		));
});