package xfer
import "testing"
// decodeContainer is openContainer for a test reading a reply it trusts.
func decodeContainer(raw []byte) []byte {
body, _, _ := openContainer(raw, maxDecoded)
return body
}
// The gate must classify cards exactly as zit's tokenizer does: an
// indented push/login card is honored by the backend, so missing it is
// a full auth bypass (audit CRITICAL, 2026-08-16).
func TestScanRequestWhitespaceCards(t *testing.T) {
for _, tc := range []struct {
name string
body string
push bool
user string
}{
{"plain push", "pragma x\npush SRV PRJ\nfile H 1\n", true, ""},
{"space-indented push", "pragma x\n push SRV PRJ\nfile H 1\n", true, ""},
{"tab-indented push", "pragma x\n\tpush SRV PRJ\n", true, ""},
{"VT-indented push", "pragma x\n\x0bpush SRV PRJ\n", true, ""},
{"FF-indented push", "pragma x\n\x0cpush SRV PRJ\n", true, ""},
{"CR-indented push", "pragma x\n\rpush SRV PRJ\n", true, ""},
{"multi-space run", "pragma x\n push SRV PRJ\n", true, ""},
{"indented login", "pragma x\n login dan aaa bbb\npush SRV PRJ\n", true, "dan"},
{"malformed push arity still gates", "pragma x\n push SRV\n", true, ""},
{"pull only, no push", "pragma x\npull SRV PRJ\n", false, ""},
} {
t.Run(tc.name, func(t *testing.T) {
pr := scanRequest([]byte(tc.body))
if pr.hasPush != tc.push {
t.Fatalf("hasPush=%v, want %v", pr.hasPush, tc.push)
}
if pr.user != tc.user {
t.Fatalf("user=%q, want %q", pr.user, tc.user)
}
})
}
// The project code must still be extracted from an indented card.
if pr := scanRequest([]byte("pragma x\n push SRV PROJ123\n")); pr.projectCode != "PROJ123" {
t.Fatalf("indented push projectCode=%q", pr.projectCode)
}
}