test(ai-review): 補上安全與 Gitea 契約測試

test/gitrepo.test.js

@@ -0,0 +1,24 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const gitrepo = require('../src/lib/gitrepo');
+
+test('assertSafeBranchRef 接受一般分支名稱', () => {
+  assert.equal(gitrepo.__test.assertSafeBranchRef('feature/review-123', 'baseRef'), 'feature/review-123');
+});
+
+test('assertSafeBranchRef 拒絕路徑穿越分支名稱', () => {
+  assert.throws(
+    () => gitrepo.__test.assertSafeBranchRef('../../hooks/pre-push', 'baseRef'),
+    /不是安全的分支名稱/,
+  );
+});
+
+test('resolveMergeBase 會在 git fetch 前拒絕不安全 baseRef', () => {
+  assert.throws(
+    () => gitrepo.resolveMergeBase(process.cwd(), '../../hooks/pre-push'),
+    /不是安全的分支名稱/,
+  );
+});