import { test } from 'node:test';
import assert from 'node:assert/strict';
import { createSpecialActionHandler } from '../src/cloud-functions/special-actions.js';

test('ai cloud action forwards only the allow-listed completion fields', async () => {
  let captured: Record<string, unknown> | undefined;
  const handler = createSpecialActionHandler({
    ai: { createChatCompletion: async (body: Record<string, unknown>) => { captured = body; return new Response(JSON.stringify({ choices: [] }), { status: 200 }); } } as any,
    domestic: {} as any,
  });
  const response = { json(value: unknown) { return value; } } as any;
  const handled = await handler({} as any, response, 'ai.chat', {
    workspaceId: 'workspace-a', action: 'ai.chat', messages: [{ role: 'user', content: 'hello' }], model: 'test-model', secret: 'must-not-forward', stream: true,
  }, 'request-1');
  assert.equal(handled, true);
  assert.deepEqual(captured, { messages: [{ role: 'user', content: 'hello' }], model: 'test-model', stream: false });
});

test('local upstream adapter rejects arbitrary URLs before configuration lookup', async () => {
  const handler = createSpecialActionHandler({ ai: {} as any, domestic: {} as any });
  const response = {} as any;
  await assert.rejects(
    handler({} as any, response, 'upstream.amazon', { path: 'https://attacker.invalid/relay', operation: 'get' }, 'request-2'),
    (error: any) => error?.code === 'upstream_path_not_allowed',
  );
});