28 lines
1.1 KiB
TypeScript
28 lines
1.1 KiB
TypeScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import type { DataSource } from 'typeorm';
|
|
import { AssetTemporalService } from '../../src/asset-master/asset-temporal.service';
|
|
import { ListTemporalAssetsQueryDto } from '../../src/asset-master/dto/list-temporal-assets-query.dto';
|
|
|
|
test('temporal reconstruction parameterizes dates and user searches', async () => {
|
|
const calls: Array<{ sql: string; parameters: unknown[] }> = [];
|
|
const dataSource = {
|
|
query: async (sql: string, parameters: unknown[]) => {
|
|
calls.push({ sql, parameters });
|
|
return calls.length === 1 ? [{ total: 0 }] : [];
|
|
},
|
|
} as unknown as DataSource;
|
|
const service = new AssetTemporalService(dataSource);
|
|
const query = Object.assign(new ListTemporalAssetsQueryDto(), {
|
|
at: '2026-08-14T15:00:00.000Z',
|
|
search: "ACT' OR 1=1 --",
|
|
});
|
|
|
|
const result = await service.list(query);
|
|
assert.equal(result.meta.total, 0);
|
|
assert.equal(calls[0].sql.includes("ACT' OR 1=1"), false);
|
|
assert.match(calls[0].sql, /occurred_at <= \$1/);
|
|
assert.match(calls[0].sql, /ILIKE \$2/);
|
|
assert.equal(calls[0].parameters[1], "%ACT' OR 1=1 --%");
|
|
});
|