import pytest
from httpx import AsyncClient
from app.services.fichier_service import FichierService

@pytest.mark.asyncio
async def test_fichier_service_path_traversal():
    service = FichierService()
    path = service.get_path("valid_file.jpg")
    assert path.name == "valid_file.jpg"
    
    with pytest.raises(ValueError) as exc_info:
        service.get_path("../etc/passwd")
    assert "accès non autorisé" in str(exc_info.value)

@pytest.mark.asyncio
async def test_download_endpoint_path_traversal_blocked(client: AsyncClient):
    # Create guest session to authenticate
    response = await client.post(
        "/api/v1/guest/sessions",
        json={"telephone": "+2250700000000", "deviceFingerprint": "fp-device-001"},
    )
    assert response.status_code == 201
    guest_id = response.json()["data"]["guestId"]
    
    # Try downloading with a single-segment traversal path (URL-encoded ..)
    resp = await client.get(
        "/api/v1/fichiers/download/%2e%2e",
        headers={"X-Guest-Id": guest_id}
    )
    assert resp.status_code == 400
    assert "accès non autorisé" in resp.json()["message"]