import test from 'node:test';
import assert from 'node:assert/strict';
import {sendEmail,tenderDigestHtml} from '../server/email.mjs';
test('email transport preserves pinned sender and idempotency key, bounds requests and rejects ambiguous success',async()=>{
 const original=globalThis.fetch,oldKey=process.env.RESEND_API_KEY;process.env.RESEND_API_KEY='re_synthetic_only';
 try {
  let request;
  globalThis.fetch=async(url,options)=>{request=options;return {ok:true,json:async()=>({id:'provider-id'})};};
  const mail={to:'qa@example.test',subject:'QA',html:'<p>QA</p>',from:'Pinned <qa@example.test>',idempotencyKey:'notify/123'};
  assert.equal((await sendEmail(mail)).id,'provider-id');
  assert.equal(request.headers['Idempotency-Key'],'notify/123');assert.equal(JSON.parse(request.body).from,mail.from);assert.ok(request.signal instanceof AbortSignal);
  globalThis.fetch=async()=>({ok:true,json:async()=>({})});
  await assert.rejects(sendEmail(mail),/sonucu belirsiz/);
  globalThis.fetch=async()=>assert.fail('invalid key must not reach provider');
  await assert.rejects(sendEmail({...mail,idempotencyKey:'bad\r\nkey'}),/Geçersiz/);
 }finally {globalThis.fetch=original;if(oldKey===undefined)delete process.env.RESEND_API_KEY;else process.env.RESEND_API_KEY=oldKey;}
});
test('digest includes every selected tender and escapes untrusted content',()=>{
 const html=tenderDigestHtml({name:'<script>',tenders:Array.from({length:25},(_,i)=>({baslik:'KALEM-'+i,sehir:'<img>',tarih:'10.09.2026'}))});
 for(let i=0;i<25;i++)assert.ok(html.includes('>KALEM-'+i+'<'));
 assert.ok(html.includes('&lt;script&gt;'));assert.ok(html.includes('&lt;img&gt;'));assert.equal(html.includes('<script>'),false);
});