these too

screenshot/src/validation.test.ts

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildScreenshotRequest, ValidationError } from './validation.js';
+
+test('buildScreenshotRequest accepts supported screenshot parameters', () => {
+  const result = buildScreenshotRequest({
+    lat: '51.5074',
+    lon: '-0.1278',
+    zoom: '12.5',
+    tab: 'properties',
+    og: '1',
+    path: '/invite/abc123',
+    filter: ['Last known price:100000:500000', 'Total floor area (sqm):50:150'],
+    poi: 'supermarket',
+    tt: 'transit:kings-cross:Kings Cross:b:0:30',
+  });
+
+  assert.equal(result.pagePath, '/invite/abc123');
+  assert.equal(result.qs.get('lat'), '51.5074');
+  assert.equal(result.qs.get('lon'), '-0.1278');
+  assert.equal(result.qs.get('zoom'), '12.5');
+  assert.equal(result.qs.get('tab'), 'properties');
+  assert.deepEqual(result.qs.getAll('filter'), [
+    'Last known price:100000:500000',
+    'Total floor area (sqm):50:150',
+  ]);
+});
+
+test('buildScreenshotRequest rejects invalid numeric values', () => {
+  assert.throws(
+    () => buildScreenshotRequest({ lat: '91', lon: '-0.1', zoom: '12' }),
+    ValidationError,
+  );
+  assert.throws(
+    () => buildScreenshotRequest({ lat: '51abc', lon: '-0.1', zoom: '12' }),
+    ValidationError,
+  );
+});
+
+test('buildScreenshotRequest rejects unsafe paths', () => {
+  assert.throws(() => buildScreenshotRequest({ path: '//example.com' }), ValidationError);
+  assert.throws(() => buildScreenshotRequest({ path: '/../../etc/passwd' }), ValidationError);
+});
+
+test('buildScreenshotRequest limits repeated parameters', () => {
+  assert.throws(
+    () =>
+      buildScreenshotRequest({
+        filter: Array.from({ length: 41 }, (_, index) => `Feature ${index}:0:1`),
+      }),
+    ValidationError,
+  );
+});
+
+test('buildScreenshotRequest rejects control characters', () => {
+  assert.throws(() => buildScreenshotRequest({ filter: 'Feature:\u0000:1' }), ValidationError);
+});