import { describe, expect, it } from 'vitest';
import { objectsToCsv, rowsToCsv, rowsToSpreadsheetSafeCsv } from '../../src/exports/csv-export';

describe('CSV export security', () => {
  it('preserves formula-like source values for internal serialization', () => {
    expect(rowsToCsv([['=1+1', '+cmd', '-2', '@name']])).toBe('=1+1;+cmd;-2;@name');
  });

  it('neutralizes formula-like values in spreadsheet-facing exports', () => {
    expect(rowsToSpreadsheetSafeCsv([['=1+1', '  +cmd', '-2', '@name', 'plain']]))
      .toBe("\"'=1+1\";\"'  +cmd\";\"'-2\";\"'@name\";plain");
  });

  it('uses the configured delimiter and protects object exports', () => {
    expect(rowsToCsv([['a,b', 'c']], ',')).toBe('"a,b",c');
    expect(objectsToCsv([{ finding: '=HYPERLINK("https://example.invalid")' }]))
      .toBe('finding\n"\'=HYPERLINK(""https://example.invalid"")"');
  });
});