esg/test/unit/car-inquiry-safety.spec.ts

import {
  assertCarPolicyOwnedBy,
  createCarOwnershipMismatchError,
  isCarOwnershipMatch,
  publicErrorLeaksNationalCode,
} from '../../src/common/helpers/car-inquiry-safety.helper';

const REQUESTED = '6269944419';
const OWNER = '4311402422';

function formatError(
  providerMessage?: string,
  providerCode?: string,
  fallbackMessage?: string,
  extras?: Record<string, unknown>,
): Error {
  const error = new Error(fallbackMessage ?? providerMessage ?? 'failed');
  (
    error as Error & {
      normalizedError: {
        code?: string;
        message: string;
        providerMessage?: string;
        conflict?: Record<string, string>;
      };
    }
  ).normalizedError = {
    code: providerCode,
    message: fallbackMessage ?? 'failed',
    providerMessage,
    conflict: extras?.conflict as Record<string, string> | undefined,
  };
  return error;
}

describe('car inquiry privacy', () => {
  it('treats a plate/chassis record as a match only when owner national code equals the requester', () => {
    expect(isCarOwnershipMatch(REQUESTED, { NtnlId: OWNER })).toBe(false);
    expect(isCarOwnershipMatch(OWNER, { NtnlId: OWNER })).toBe(true);
    expect(isCarOwnershipMatch(REQUESTED, {})).toBe(false);
  });

  it('never puts the real owner national code on a mismatch error', () => {
    const error = createCarOwnershipMismatchError(formatError);
    const payload = (error as Error & { normalizedError: unknown }).normalizedError;

    expect(publicErrorLeaksNationalCode(payload, OWNER)).toBe(false);
    expect(payload).toMatchObject({
      code: 'INQUIRY_NO_MATCH',
      message: 'Inquiry returned no matching result',
    });
    expect((payload as { conflict?: unknown }).conflict).toBeUndefined();
  });

  it('throws the same generic no-match when plate belongs to someone else', () => {
    expect(() =>
      assertCarPolicyOwnedBy(REQUESTED, { NtnlId: OWNER, InsNam: 'سهيل حاجي زاده' }, formatError),
    ).toThrow();

    try {
      assertCarPolicyOwnedBy(REQUESTED, { NtnlId: OWNER }, formatError);
    } catch (error) {
      expect(publicErrorLeaksNationalCode(error, OWNER)).toBe(false);
      expect(JSON.stringify(error)).not.toContain('سهيل');
    }
  });
});