};

}

function guardedFetchCall(index: number): Parameters<typeof fetchWithSsrFGuard>[0] {

const call = mockGuardedFetch.mock.calls.at(index)?.at(0);

if (call === undefined) {

throw new Error(`expected guarded fetch call ${index}`);

}

return call;

}

describe("uploadFile memex upload hardening", () => {

beforeEach(() => {

vi.clearAllMocks();

expect(result).toEqual({ url: "https://memex.tlon.network/files/uploaded.png" });

expect(vi.mocked(globalThis.fetch)).not.toHaveBeenCalled();

expect(mockGuardedFetch).toHaveBeenCalledTimes(2);

const firstCall = mockGuardedFetch.mock.calls[0]?.[0];

const firstCall = guardedFetchCall(0);

expect(firstCall?.url).toBe("https://memex.tlon.network/v1/zod/upload");

expect(firstCall?.init?.method).toBe("PUT");

expect(firstCall?.init?.headers).toEqual({ "Content-Type": "application/json" });

expect(firstBody.contentLength).toBe(11);

expect(firstBody.contentType).toBe("image/png");

expect(typeof firstBody.fileName).toBe("string");

const secondCall = mockGuardedFetch.mock.calls[1]?.[0];

const secondCall = guardedFetchCall(1);

expect(secondCall?.url).toBe("https://uploads.tlon.network/put");

expect(secondCall?.init?.method).toBe("PUT");

expect(secondCall?.init?.headers).toEqual({

expect(vi.mocked(globalThis.fetch)).not.toHaveBeenCalled();

expect(mockGuardedFetch).toHaveBeenCalledTimes(2);

const uploadCall = mockGuardedFetch.mock.calls[1]?.[0];

const uploadCall = guardedFetchCall(1);

expect(uploadCall?.url).toBe("https://uploads.tlon.network/put");

expect(uploadCall?.auditContext).toBe("tlon-memex-upload");

expect(uploadCall?.capture).toBe(false);

expect(vi.mocked(globalThis.fetch)).not.toHaveBeenCalled();

expect(mockGuardedFetch).toHaveBeenCalledTimes(2);

const uploadCall = mockGuardedFetch.mock.calls[1]?.[0];

const uploadCall = guardedFetchCall(1);

expect(uploadCall?.url).toBe("https://uploads.tlon.network/put");

expect(uploadCall?.auditContext).toBe("tlon-memex-upload");

expect(uploadCall?.capture).toBe(false);

expect(vi.mocked(globalThis.fetch)).not.toHaveBeenCalled();

expect(mockGuardedFetch).toHaveBeenCalledTimes(1);

const lookupCall = mockGuardedFetch.mock.calls[0]?.[0];

const lookupCall = guardedFetchCall(0);

expect(lookupCall?.url).toBe("https://memex.tlon.network/v1/zod/upload");

expect(lookupCall?.auditContext).toBe("tlon-memex-upload-url");

expect(lookupCall?.capture).toBe(false);

expect(result.url.startsWith("https://files.example.com/")).toBe(true);

expect(mockGuardedFetch).toHaveBeenCalledTimes(1);

const uploadCall = mockGuardedFetch.mock.calls[0]?.[0];

const uploadCall = guardedFetchCall(0);

expect(uploadCall?.url).toBe("https://s3.example.com/uploads/file?sig=abc");

expect(uploadCall?.init?.method).toBe("PUT");

expect(uploadCall?.init?.headers).toBeUndefined();

expect(result.url.startsWith("https://files.example.com/")).toBe(true);

expect(mockGuardedFetch).toHaveBeenCalledTimes(1);

const uploadCall = mockGuardedFetch.mock.calls[0]?.[0];

const uploadCall = guardedFetchCall(0);

expect(uploadCall?.url).toBe("https://10.0.0.15/uploads/file?sig=abc");

expect(uploadCall?.auditContext).toBe("tlon-custom-s3-upload");

expect(uploadCall?.capture).toBe(false);