botfights/server/src/lib/validators.test.ts

import { describe, it, expect } from 'vitest'
import {
  pubkeySchema,
  botNameSchema,
  satsSchema,
  idSchema,
  httpUrlSchema,
  loginSchema,
  registerSchema,
  registerHumanSchema,
  updateBotSchema,
  respondSchema,
  reactSchema,
  placeBetSchema,
  depositSchema,
  withdrawSchema,
  connectWalletSchema,
  createInvoiceSchema,
  submitCashuSchema,
  zapSchema,
  disconnectWalletSchema,
  createTournamentSchema,
  joinTournamentSchema,
  startTournamentSchema,
  joinRankedSchema,
  testWebhookSchema,
} from './validators.js'

// --- Primitive schemas ---

describe('pubkeySchema', () => {
  const valid = 'a'.repeat(64)
  it('accepts valid 64-char hex', () => { expect(pubkeySchema.safeParse(valid).success).toBe(true) })
  it('rejects too short', () => { expect(pubkeySchema.safeParse('abc').success).toBe(false) })
  it('rejects too long', () => { expect(pubkeySchema.safeParse('a'.repeat(65)).success).toBe(false) })
  it('rejects non-hex', () => { expect(pubkeySchema.safeParse('g'.repeat(64)).success).toBe(false) })
  it('rejects uppercase', () => { expect(pubkeySchema.safeParse('A'.repeat(64)).success).toBe(false) })
  it('rejects empty', () => { expect(pubkeySchema.safeParse('').success).toBe(false) })
  it('rejects number', () => { expect(pubkeySchema.safeParse(12345).success).toBe(false) })
  it('rejects null', () => { expect(pubkeySchema.safeParse(null).success).toBe(false) })
})

describe('botNameSchema', () => {
  it('accepts valid names', () => {
    expect(botNameSchema.safeParse('ab').success).toBe(true)
    expect(botNameSchema.safeParse('test-bot_1').success).toBe(true)
    expect(botNameSchema.safeParse('ABCDEFGHIJKL').success).toBe(true) // 12 chars
  })
  it('rejects too short', () => { expect(botNameSchema.safeParse('a').success).toBe(false) })
  it('rejects too long', () => { expect(botNameSchema.safeParse('a'.repeat(13)).success).toBe(false) })
  it('rejects special chars', () => {
    expect(botNameSchema.safeParse('bot name').success).toBe(false) // spaces
    expect(botNameSchema.safeParse('bot@name').success).toBe(false)
    expect(botNameSchema.safeParse('<script>').success).toBe(false)
  })
  it('rejects empty', () => { expect(botNameSchema.safeParse('').success).toBe(false) })
})

describe('satsSchema', () => {
  it('accepts valid amounts', () => {
    expect(satsSchema.safeParse(1).success).toBe(true)
    expect(satsSchema.safeParse(1_000_000).success).toBe(true)
  })
  it('rejects zero', () => { expect(satsSchema.safeParse(0).success).toBe(false) })
  it('rejects negative', () => { expect(satsSchema.safeParse(-1).success).toBe(false) })
  it('rejects over max', () => { expect(satsSchema.safeParse(1_000_001).success).toBe(false) })
  it('rejects non-integer', () => { expect(satsSchema.safeParse(1.5).success).toBe(false) })
  it('rejects string', () => { expect(satsSchema.safeParse('100').success).toBe(false) })
})

describe('idSchema', () => {
  it('accepts valid IDs', () => {
    expect(idSchema.safeParse('abc123').success).toBe(true)
    expect(idSchema.safeParse('x'.repeat(24)).success).toBe(true)
  })
  it('rejects empty', () => { expect(idSchema.safeParse('').success).toBe(false) })
  it('rejects too long', () => { expect(idSchema.safeParse('x'.repeat(25)).success).toBe(false) })
})

describe('httpUrlSchema', () => {
  it('accepts http/https URLs', () => {
    expect(httpUrlSchema.safeParse('https://example.com').success).toBe(true)
    expect(httpUrlSchema.safeParse('http://api.bot.dev/hook').success).toBe(true)
  })
  it('rejects file:// URLs', () => { expect(httpUrlSchema.safeParse('file:///etc/passwd').success).toBe(false) })
  it('rejects ftp:// URLs', () => { expect(httpUrlSchema.safeParse('ftp://files.example.com').success).toBe(false) })
  it('rejects non-URLs', () => { expect(httpUrlSchema.safeParse('not a url').success).toBe(false) })
  it('rejects javascript: URLs', () => { expect(httpUrlSchema.safeParse('javascript:alert(1)').success).toBe(false) })
})

// --- Auth schemas ---

describe('loginSchema', () => {
  const validPk = 'a'.repeat(64)
  it('accepts valid login', () => { expect(loginSchema.safeParse({ pubkey: validPk }).success).toBe(true) })
  it('rejects missing pubkey', () => { expect(loginSchema.safeParse({}).success).toBe(false) })
  it('rejects bad pubkey', () => { expect(loginSchema.safeParse({ pubkey: 'short' }).success).toBe(false) })
})

describe('registerSchema', () => {
  const base = { pubkey: 'a'.repeat(64), name: 'testbot' }
  it('accepts minimal registration', () => { expect(registerSchema.safeParse(base).success).toBe(true) })
  it('accepts full registration', () => {
    expect(registerSchema.safeParse({
      ...base,
      webhookUrl: 'https://mybot.com/hook',
      archetype: 'warrior',
      profilePicUrl: 'https://img.com/pic.png',
      customization: { color: 'red' },
    }).success).toBe(true)
  })
  it('accepts empty webhook (poll mode)', () => {
    expect(registerSchema.safeParse({ ...base, webhookUrl: '' }).success).toBe(true)
  })
  it('rejects bad name', () => {
    expect(registerSchema.safeParse({ ...base, name: 'x' }).success).toBe(false) // too short
    expect(registerSchema.safeParse({ ...base, name: 'x'.repeat(13) }).success).toBe(false) // too long
    expect(registerSchema.safeParse({ ...base, name: 'bad name!' }).success).toBe(false) // special chars
  })
  it('rejects bad pubkey', () => {
    expect(registerSchema.safeParse({ ...base, pubkey: 'bad' }).success).toBe(false)
  })
})

describe('registerHumanSchema', () => {
  const base = { pubkey: 'a'.repeat(64), name: 'human01' }
  it('accepts valid human registration', () => { expect(registerHumanSchema.safeParse(base).success).toBe(true) })
  it('accepts with avatar seed', () => {
    expect(registerHumanSchema.safeParse({ ...base, avatarSeed: 'seed123' }).success).toBe(true)
  })
})

describe('updateBotSchema', () => {
  const base = { pubkey: 'a'.repeat(64) }
  it('accepts pubkey only (no updates)', () => { expect(updateBotSchema.safeParse(base).success).toBe(true) })
  it('accepts webhook update', () => {
    expect(updateBotSchema.safeParse({ ...base, webhookUrl: 'https://new.com/hook' }).success).toBe(true)
  })
  it('rejects file:// webhook', () => {
    expect(updateBotSchema.safeParse({ ...base, webhookUrl: 'file:///etc/passwd' }).success).toBe(false)
  })
})

// --- Fight schemas ---

describe('respondSchema', () => {
  it('accepts valid response', () => {
    expect(respondSchema.safeParse({ answer: 'hello' }).success).toBe(true)
  })
  it('accepts with trash talk', () => {
    expect(respondSchema.safeParse({ answer: 'hello', trashTalk: 'rekt' }).success).toBe(true)
  })
  it('rejects answer > 2000 chars', () => {
    expect(respondSchema.safeParse({ answer: 'x'.repeat(2001) }).success).toBe(false)
  })
  it('rejects trash talk > 200 chars', () => {
    expect(respondSchema.safeParse({ answer: 'ok', trashTalk: 'x'.repeat(201) }).success).toBe(false)
  })
})

describe('reactSchema', () => {
  it('accepts valid emoji', () => { expect(reactSchema.safeParse({ emoji: '🔥' }).success).toBe(true) })
  it('rejects empty emoji', () => { expect(reactSchema.safeParse({ emoji: '' }).success).toBe(false) })
  it('rejects oversized emoji', () => { expect(reactSchema.safeParse({ emoji: '🔥'.repeat(5) }).success).toBe(false) })
})

// --- Bet schemas ---

describe('placeBetSchema', () => {
  const valid = {
    fightId: 'fight123',
    pubkey: 'a'.repeat(64),
    botId: 'bot456',
    amountSats: 1000,
    cashuToken: 'cashuAey...',
  }
  it('accepts valid bet', () => { expect(placeBetSchema.safeParse(valid).success).toBe(true) })
  it('rejects zero amount', () => {
    expect(placeBetSchema.safeParse({ ...valid, amountSats: 0 }).success).toBe(false)
  })
  it('rejects negative amount', () => {
    expect(placeBetSchema.safeParse({ ...valid, amountSats: -100 }).success).toBe(false)
  })
  it('rejects over-max amount', () => {
    expect(placeBetSchema.safeParse({ ...valid, amountSats: 999999999 }).success).toBe(false)
  })
  it('rejects non-integer amount', () => {
    expect(placeBetSchema.safeParse({ ...valid, amountSats: 1.5 }).success).toBe(false)
  })
  it('rejects missing fields', () => {
    expect(placeBetSchema.safeParse({ fightId: 'x' }).success).toBe(false)
  })
  it('rejects empty cashu token', () => {
    expect(placeBetSchema.safeParse({ ...valid, cashuToken: '' }).success).toBe(false)
  })
})

describe('depositSchema', () => {
  it('accepts valid deposit', () => {
    expect(depositSchema.safeParse({ amountSats: 500, pubkey: 'a'.repeat(64) }).success).toBe(true)
  })
  it('rejects under minimum (100)', () => {
    expect(depositSchema.safeParse({ amountSats: 50, pubkey: 'a'.repeat(64) }).success).toBe(false)
  })
})

describe('withdrawSchema', () => {
  it('accepts valid withdrawal', () => {
    expect(withdrawSchema.safeParse({ cashuToken: 'tok', bolt11: 'lnbc...' }).success).toBe(true)
  })
  it('rejects missing bolt11', () => {
    expect(withdrawSchema.safeParse({ cashuToken: 'tok' }).success).toBe(false)
  })
})

// --- Payment schemas ---

describe('connectWalletSchema', () => {
  const valid = { pubkey: 'a'.repeat(64), method: 'nwc' as const, connectionData: 'nostr+walletconnect://...' }
  it('accepts valid connection', () => { expect(connectWalletSchema.safeParse(valid).success).toBe(true) })
  it('rejects invalid method', () => {
    expect(connectWalletSchema.safeParse({ ...valid, method: 'paypal' }).success).toBe(false)
  })
  it('rejects empty connectionData', () => {
    expect(connectWalletSchema.safeParse({ ...valid, connectionData: '' }).success).toBe(false)
  })
})

describe('zapSchema', () => {
  const valid = { winnerId: 'bot1', fightId: 'fight1', amountSats: 100 }
  it('accepts valid zap', () => { expect(zapSchema.safeParse(valid).success).toBe(true) })
  it('rejects zero sats', () => { expect(zapSchema.safeParse({ ...valid, amountSats: 0 }).success).toBe(false) })
})

// --- Tournament schemas ---

describe('createTournamentSchema', () => {
  const valid = { pubkey: 'a'.repeat(64), name: 'Lightning Cup' }
  it('accepts minimal tournament', () => { expect(createTournamentSchema.safeParse(valid).success).toBe(true) })
  it('accepts full tournament', () => {
    expect(createTournamentSchema.safeParse({
      ...valid, format: 'round_robin', size: 16, entrySats: 500,
    }).success).toBe(true)
  })
  it('rejects invalid size', () => {
    expect(createTournamentSchema.safeParse({ ...valid, size: 64 }).success).toBe(false)
  })
  it('rejects empty name', () => {
    expect(createTournamentSchema.safeParse({ ...valid, name: '' }).success).toBe(false)
  })
  it('rejects name > 100 chars', () => {
    expect(createTournamentSchema.safeParse({ ...valid, name: 'x'.repeat(101) }).success).toBe(false)
  })
})

// --- Queue schemas ---

describe('joinRankedSchema', () => {
  it('accepts valid join', () => {
    expect(joinRankedSchema.safeParse({ paymentId: 'pay123' }).success).toBe(true)
  })
  it('accepts with pubkey', () => {
    expect(joinRankedSchema.safeParse({ paymentId: 'pay123', pubkey: 'a'.repeat(64) }).success).toBe(true)
  })
  it('rejects missing paymentId', () => {
    expect(joinRankedSchema.safeParse({}).success).toBe(false)
  })
})

// --- Attack inputs ---

describe('attack inputs', () => {
  it('rejects SQL injection in pubkey', () => {
    expect(pubkeySchema.safeParse("' OR 1=1 --").success).toBe(false)
  })
  it('rejects XSS in bot name', () => {
    expect(botNameSchema.safeParse('<img onerror=alert(1)>').success).toBe(false)
  })
  it('rejects prototype pollution in customization keys', () => {
    // The schema allows unknown keys, but Zod strips __proto__ in strict mode
    const result = registerSchema.safeParse({
      pubkey: 'a'.repeat(64),
      name: 'test01',
      customization: { __proto__: { admin: true } },
    })
    // This should still parse (customization is z.record(z.unknown()))
    // The actual protection is that we never spread customization into objects unsafely
    expect(result.success).toBe(true)
  })
  it('rejects absurdly long answer', () => {
    expect(respondSchema.safeParse({ answer: 'x'.repeat(10000) }).success).toBe(false)
  })
  it('rejects negative sats in deposit', () => {
    expect(depositSchema.safeParse({ amountSats: -1, pubkey: 'a'.repeat(64) }).success).toBe(false)
  })
  it('rejects data: URL in webhook', () => {
    expect(httpUrlSchema.safeParse('data:text/html,<h1>hi</h1>').success).toBe(false)
  })
})