import { describe, it, expect } from 'vitest';
import { buildFilter, escapeFilterValue } from './ldapClient.js';

describe('LDAP filter building', () => {
  it('substitutes {{username}} into the filter template', () => {
    expect(buildFilter('(mail={{username}})', 'alice@example.com')).toBe('(mail=alice@example.com)');
  });

  it('escapes RFC 4515 special characters to prevent filter injection', () => {
    // An attacker-supplied "*" or parentheses must not alter the filter shape.
    expect(escapeFilterValue('*)(uid=*')).toBe('\\2a\\29\\28uid=\\2a');
    expect(buildFilter('(uid={{username}})', 'a*b')).toBe('(uid=a\\2ab)');
  });
});