import assert from 'node:assert/strict'; import test from 'node:test'; import type { DataSource } from 'typeorm'; import { AssetTemporalService } from '../../src/asset-master/asset-temporal.service'; import { ListTemporalAssetsQueryDto } from '../../src/asset-master/dto/list-temporal-assets-query.dto'; test('temporal reconstruction parameterizes dates and user searches', async () => { const calls: Array<{ sql: string; parameters: unknown[] }> = []; const dataSource = { query: async (sql: string, parameters: unknown[]) => { calls.push({ sql, parameters }); return calls.length === 1 ? [{ total: 0 }] : []; }, } as unknown as DataSource; const service = new AssetTemporalService(dataSource); const query = Object.assign(new ListTemporalAssetsQueryDto(), { at: '2026-08-14T15:00:00.000Z', search: "ACT' OR 1=1 --", }); const result = await service.list(query); assert.equal(result.meta.total, 0); assert.equal(calls[0].sql.includes("ACT' OR 1=1"), false); assert.match(calls[0].sql, /occurred_at <= \$1/); assert.match(calls[0].sql, /ILIKE \$2/); assert.equal(calls[0].parameters[1], "%ACT' OR 1=1 --%"); });