import { beforeEach, describe, expect, it, vi } from "vitest";

const resolvePinnedHostnameWithPolicyMock = vi.fn();

const { resolvePinnedHostnameWithPolicyMock } = vi.hoisted(() => ({

resolvePinnedHostnameWithPolicyMock: vi.fn(),

}));

vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({

resolvePinnedHostnameWithPolicy: (...args: unknown[]) =>

import { deleteWebhook, getWebhookInfo, sendChatAction, sendPhoto, type ZaloFetch } from "./api.js";

const MAX_TIMER_TIMEOUT_MS = 2_147_000_000;

function createOkFetcher() {

return vi.fn<ZaloFetch>(async () => new Response(JSON.stringify({ ok: true, result: {} })));

}

}

});

it("caps oversized sendChatAction timeouts before scheduling the timer", async () => {

const setTimeoutMock = vi

.spyOn(globalThis, "setTimeout")

.mockImplementation((() => 1) as typeof setTimeout);

const clearTimeoutMock = vi

.spyOn(globalThis, "clearTimeout")

.mockImplementation(() => undefined);

try {

const fetcher = vi.fn<ZaloFetch>(

async () =>

({

json: async () => ({ ok: true, result: {} }),

}) as Response,

);

await sendChatAction(

"test-token",

{

chat_id: "chat-123",

action: "typing",

},

fetcher,

MAX_TIMER_TIMEOUT_MS + 1_000_000,

);

expect(setTimeoutMock).toHaveBeenCalledWith(expect.any(Function), MAX_TIMER_TIMEOUT_MS);

} finally {

setTimeoutMock.mockRestore();

clearTimeoutMock.mockRestore();

}

});

it("validates outbound photo URLs against the SSRF guard before posting", async () => {

const fetcher = createOkFetcher();