import { describe, it, expect } from "vitest";
import { inPlaceholders } from "./sqlFilters";

describe("inPlaceholders", () => {
  it("returns null for undefined ids (no filter)", () => {
    expect(inPlaceholders(undefined, 1)).toBeNull();
  });

  it("returns null for an empty array (no filter)", () => {
    expect(inPlaceholders([], 1)).toBeNull();
  });

  it("builds a single placeholder for one id", () => {
    expect(inPlaceholders([7], 1)).toBe("$1");
  });

  it("builds one placeholder per id, starting at startIndex", () => {
    expect(inPlaceholders([3, 7, 12], 4)).toBe("$4, $5, $6");
  });

  it("never joins the raw id values into the string (CWE-89 guard)", () => {
    const result = inPlaceholders([3, 7], 1);
    expect(result).not.toContain("3");
    expect(result).not.toContain("7");
    expect(result).toBe("$1, $2");
  });
});