"""Wave 0：输入防护测试。"""


def test_block_sql_injection_in_chat(client):
    login = client.post("/api/auth/login", json={"actor_id": "STAFF-20001", "token_type": "staff"})
    token = login.json()["data"]["access_token"]
    resp = client.post(
        "/api/chat",
        json={"message": "please DROP TABLE users"},
        headers={
            "Authorization": f"Bearer {token}",
            "X-Agent-Type": "analyst",
        },
    )
    assert resp.status_code == 400
    assert resp.json()["code"] == 400