const assert = require('node:assert/strict');
const test = require('node:test');

const CaptchaPages = require('../public/js/captcha-pages.js');

test('captcha request bodies keep operationCode in the URL and never submit legacy client or scene fields', () => {
  const api = { tenantId: '000000', clientId: 'web-client' };
  const challenge = CaptchaPages.buildChallengeBody({
    operationCode: 'sms-login',
    subject: '13800000000'
  }, api);
  const verification = CaptchaPages.buildVerifyBody({
    data: {
      trackList: [{ x: 0, y: 0 }, { x: 120, y: 4 }]
    }
  }, {
    operationCode: 'sms-login',
    subject: '13800000000',
    challengeId: 'challenge-1'
  }, api);

  assert.deepEqual(challenge, {
    tenantId: '000000',
    subject: '13800000000'
  });
  assert.deepEqual(verification, {
    tenantId: '000000',
    subject: '13800000000',
    challengeId: 'challenge-1',
    providerCode: 'tianai',
    captchaType: 'SLIDER',
    payload: {
      track: {
        trackList: [{ x: 0, y: 0 }, { x: 120, y: 4 }],
        left: 120,
        top: 4
      }
    }
  });
  assert.equal('clientId' in challenge, false);
  assert.equal('sceneCode' in challenge, false);
  assert.equal('clientId' in verification, false);
  assert.equal('sceneCode' in verification, false);
});