SnowLuma/packages/protocol/tests/web/qzone.test.ts

import { describe, it, expect, vi, afterEach } from 'vitest';
import { commentQzoneMsg, deleteQzoneMsg, getQzoneFeeds, getQzoneMsgList, mapFeeds, mapMsgList, parseQzoneJson, publishQzoneMsg, setQzoneLike } from '@snowluma/protocol/web/qzone';
import { RequestUtil } from '@snowluma/protocol/web/request-util';

// The 说说 list comes from taotao.qzone.qq.com's emotion_cgi_msglist_v6 CGI,
// proxied through h5.qzone.qq.com. The body is JSONP (`_preloadCallback({…})`)
// so we pin both the JSONP-stripping and the field renames (created_time→time,
// cmtnum→comment_num, secret→is_private, pic→largest-url images), plus the
// auth-failure throw contract — these are the only real logic in an otherwise
// thin HTTP port and would be invisible end-to-end if they regressed.

const cookies = { p_skey: 'PSK', skey: 'SK', uin: 'o10000', p_uin: 'o10000' };
const expectedGtk = (() => {
  let h = 5381;
  for (const c of 'PSK') h += (h << 5) + c.charCodeAt(0);
  return (h & 0x7fffffff).toString();
})();

describe('qzone / parseQzoneJson', () => {
  it('parses a raw JSON body', () => {
    expect(parseQzoneJson<{ a: number }>('{"a":1}')).toEqual({ a: 1 });
  });

  it('strips a JSONP callback wrapper', () => {
    expect(parseQzoneJson<{ a: number }>('_preloadCallback({"a":1});')).toEqual({ a: 1 });
  });

  it('throws on a non-object body (HTML error page)', () => {
    expect(() => parseQzoneJson('<html>nope</html>')).toThrow('invalid response from qzone api');
  });
});

describe('qzone / mapMsgList', () => {
  it('renames fields, flags private, and picks the largest pic url', () => {
    const out = mapMsgList({
      code: 0,
      total: 42,
      msglist: [
        {
          tid: 'T1',
          content: 'hello',
          created_time: 1700000000,
          cmtnum: 3,
          secret: 0,
          pic: [{ url1: 'a', url2: 'b', url3: 'c' }],
        },
        { tid: 'T2', content: 'secret one', created_time: 1700000050, cmtnum: 0, secret: 1 },
      ],
    });
    expect(out).toEqual({
      total: 42,
      msglist: [
        { tid: 'T1', content: 'hello', time: 1700000000, comment_num: 3, is_private: false, images: ['c'] },
        { tid: 'T2', content: 'secret one', time: 1700000050, comment_num: 0, is_private: true, images: [] },
      ],
    });
  });

  it('falls back to list length when total is absent and tolerates missing fields', () => {
    const out = mapMsgList({ msglist: [{ tid: 'T1' }] });
    expect(out).toEqual({
      total: 1,
      msglist: [{ tid: 'T1', content: '', time: 0, comment_num: 0, is_private: false, images: [] }],
    });
  });
});

describe('qzone / getQzoneMsgList (HTTP layer)', () => {
  afterEach(() => vi.restoreAllMocks());

  it('GETs the exact proxied url + params and maps the JSONP body', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue(
      '_preloadCallback({"code":0,"total":1,"msglist":[{"tid":"T1","content":"hi","created_time":1700000000,"cmtnum":2,"secret":0,"pic":[{"url1":"a","url3":"c"}]}]});',
    );

    const out = await getQzoneMsgList(cookies, '10000', 0, 20);

    expect(out).toEqual({
      total: 1,
      msglist: [{ tid: 'T1', content: 'hi', time: 1700000000, comment_num: 2, is_private: false, images: ['c'] }],
    });

    const [url, method, body, headers] = spy.mock.calls[0]!;
    expect(method).toBe('GET');
    expect(body).toBe('');
    expect((headers as Record<string, string>).Cookie).toContain('p_skey=PSK');
    expect(url).toContain('https://h5.qzone.qq.com/proxy/domain/taotao.qzone.qq.com/cgi-bin/emotion_cgi_msglist_v6?');
    const q = new URLSearchParams((url as string).split('?')[1]);
    expect(q.get('uin')).toBe('10000');
    expect(q.get('pos')).toBe('0');
    expect(q.get('num')).toBe('20');
    expect(q.get('g_tk')).toBe(expectedGtk);
    expect(q.get('format')).toBe('jsonp');
  });

  it('retries via the user.qzone.qq.com route on a -10000 rate-limit', async () => {
    const spy = vi
      .spyOn(RequestUtil, 'HttpGetText')
      .mockResolvedValueOnce('{"code":-10000,"message":"使用人数过多，请稍后再试"}')
      .mockResolvedValueOnce(
        '{"code":0,"total":1,"msglist":[{"tid":"T1","content":"hi","created_time":1700000000,"cmtnum":0,"secret":0,"pic":[]}]}',
      );

    const out = await getQzoneMsgList(cookies, '10000', 0, 20);

    expect(out).toEqual({
      total: 1,
      msglist: [{ tid: 'T1', content: 'hi', time: 1700000000, comment_num: 0, is_private: false, images: [] }],
    });

    expect(spy).toHaveBeenCalledTimes(2);
    expect(spy.mock.calls[0]![0]).toContain('https://h5.qzone.qq.com/proxy/domain/taotao.qzone.qq.com/');
    const [retryUrl, , , retryHeaders] = spy.mock.calls[1]!;
    expect(retryUrl).toContain('https://user.qzone.qq.com/proxy/domain/taotao.qq.com/cgi-bin/emotion_cgi_msglist_v6?');
    expect((retryHeaders as Record<string, string>).Referer).toBe('https://user.qzone.qq.com/10000');
    const q = new URLSearchParams((retryUrl as string).split('?')[1]);
    expect(q.get('format')).toBe('json');
    expect(q.get('g_tk')).toBe(expectedGtk);
  });

  it('returns an empty list (not a throw) for a genuinely empty space', async () => {
    // The throw-on-auth-failure contract hinges on distinguishing a missing
    // msglist (cookie failure → throw) from an empty msglist (no 说说 → []).
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"total":0,"msglist":[]}');
    await expect(getQzoneMsgList(cookies, '10000')).resolves.toEqual({ total: 0, msglist: [] });
  });

  it('propagates a transport error instead of swallowing it', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockRejectedValue(new Error('Unexpected status code: 403'));
    await expect(getQzoneMsgList(cookies, '10000')).rejects.toThrow('403');
  });

  it('throws on a non-zero qzone code (auth/permission), not an empty list', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":-3000,"message":"need login","subcode":0}');
    await expect(getQzoneMsgList(cookies, '10000')).rejects.toThrow('code=-3000');
  });

  it('throws when msglist is absent (cookie failure), not an empty list', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"total":0}');
    await expect(getQzoneMsgList(cookies, '10000')).rejects.toThrow('无法获取空间说说列表');
  });
});

describe('qzone / mapFeeds', () => {
  it('maps structured fields, prefers key over feedskey, and reads has_more', () => {
    const out = mapFeeds({
      code: 0,
      data: {
        hasmore: 1,
        data: [
          { uin: 12345, nickname: 'Alice', abstime: 1700000000, appid: 311, key: 'K1', html: '<div>a</div>' },
          { uin: '67890', nickname: 'Bob', abstime: '1700000050', appid: '4', feedskey: 'FK2', html: '<div>b</div>' },
        ],
      },
    });
    expect(out).toEqual({
      has_more: true,
      feeds: [
        { uin: 12345, nickname: 'Alice', time: 1700000000, appid: 311, key: 'K1', html: '<div>a</div>' },
        { uin: 67890, nickname: 'Bob', time: 1700000050, appid: 4, key: 'FK2', html: '<div>b</div>' },
      ],
    });
  });

  it('tolerates missing fields and empty data', () => {
    expect(mapFeeds({ code: 0, data: { data: [] } })).toEqual({ feeds: [], has_more: false });
  });
});

describe('qzone / getQzoneFeeds (HTTP layer)', () => {
  afterEach(() => vi.restoreAllMocks());

  it('GETs the exact feeds url + params and maps the JSONP body', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue(
      '_preloadCallback({"code":0,"data":{"hasmore":1,"data":[{"uin":12345,"nickname":"Alice","abstime":1700000000,"appid":311,"key":"K1","html":"<div>a</div>"}]}});',
    );

    const out = await getQzoneFeeds(cookies, '10000', 2, 10);

    expect(out).toEqual({
      has_more: true,
      feeds: [{ uin: 12345, nickname: 'Alice', time: 1700000000, appid: 311, key: 'K1', html: '<div>a</div>' }],
    });

    const [url, method, body, headers] = spy.mock.calls[0]!;
    expect(method).toBe('GET');
    expect(body).toBe('');
    expect((headers as Record<string, string>).Cookie).toContain('p_skey=PSK');
    // Routed through the h5.qzone proxy gateway (NOT ic2 directly), because
    // the qzone.qq.com cookie jar only authenticates against the proxy origin.
    expect(url).toContain('https://h5.qzone.qq.com/proxy/domain/ic2.qzone.qq.com/cgi-bin/feeds/feeds3_html_more?');
    const q = new URLSearchParams((url as string).split('?')[1]);
    expect(q.get('uin')).toBe('10000');
    expect(q.get('pagenum')).toBe('2');
    expect(q.get('count')).toBe('10');
    expect(q.get('g_tk')).toBe(expectedGtk);
    // The request asks for JSONP — pin it so the JSONP-bodied response above
    // actually exercises the requested format (not just the tolerant parser).
    expect(q.get('format')).toBe('jsonp');
  });

  it('returns an empty list (not a throw) for a genuinely empty feed', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('_preloadCallback({"code":0,"data":{"data":[],"hasmore":0}});');
    await expect(getQzoneFeeds(cookies, '10000')).resolves.toEqual({ feeds: [], has_more: false });
  });

  it('throws on a non-zero qzone code', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('_preloadCallback({"code":-3000,"message":"need login"});');
    await expect(getQzoneFeeds(cookies, '10000')).rejects.toThrow('code=-3000');
  });

  it('throws when the data array is absent (cookie failure), not an empty list', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('_preloadCallback({"code":0,"data":{}});');
    await expect(getQzoneFeeds(cookies, '10000')).rejects.toThrow('无法获取空间好友动态');
  });
});

describe('qzone / publishQzoneMsg (HTTP layer)', () => {
  afterEach(() => vi.restoreAllMocks());

  it('POSTs a form-urlencoded body and reads the real t1_tid/t1_time (string) success fields', async () => {
    // The real publish_v6 success envelope names the new feed id `t1_tid`
    // and the post time `t1_time` (a STRING) — reading `tid`/`now` would
    // false-throw on every successful publish.
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue(
      '{"code":0,"t1_tid":"NEWTID","t1_time":"1700000000"}',
    );

    const out = await publishQzoneMsg(cookies, '10000', 'hello 世界 & friends');

    expect(out).toEqual({ tid: 'NEWTID', time: 1700000000 });

    const [url, method, body, headers] = spy.mock.calls[0]!;
    expect(method).toBe('POST');
    expect(url).toBe(
      `https://h5.qzone.qq.com/proxy/domain/taotao.qzone.qq.com/cgi-bin/emotion_cgi_publish_v6?g_tk=${expectedGtk}`,
    );
    const h = headers as Record<string, string>;
    expect(h['Content-Type']).toBe('application/x-www-form-urlencoded');
    expect(h.Cookie).toContain('p_skey=PSK');
    // form body carries the content (urlencoded, incl. the `&`) and host uin
    const form = new URLSearchParams(body as string);
    expect(form.get('con')).toBe('hello 世界 & friends');
    expect(form.get('hostuin')).toBe('10000');
    expect(form.get('who')).toBe('1');
    expect(form.get('ugc_right')).toBe('1');
    expect(form.has('allow_uins')).toBe(false);
    expect(form.get('format')).toBe('json');
    expect(form.get('qzreferrer')).toBe('https://user.qzone.qq.com/10000');
  });

  it('threads image richType/richval into the publish form', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue(
      '{"code":0,"t1_tid":"NEWTID","t1_time":"1700000000"}',
    );
    const richval = ',12345,abc,abc,22,800,600,,800,600\t,12346,def,def,22,640,480,,640,480';

    await publishQzoneMsg(cookies, '10000', 'with images', 1, richval);

    const form = new URLSearchParams(spy.mock.calls[0]![2] as string);
    expect(form.get('richtype')).toBe('1');
    expect(form.get('richval')).toBe(richval);
  });

  it('threads publish permission fields for restricted visibility', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue(
      '{"code":0,"t1_tid":"RIGHTTID","t1_time":"1700000000"}',
    );

    await expect(publishQzoneMsg(cookies, '10000', 'limited', undefined, undefined, 16, '10001 | 10002|10001')).resolves.toEqual({
      tid: 'RIGHTTID',
      time: 1700000000,
    });

    const [, , body] = spy.mock.calls[0]!;
    const form = new URLSearchParams(body as string);
    expect(form.get('ugc_right')).toBe('16');
    expect(form.get('allow_uins')).toBe('10001|10002');
    expect(form.get('who')).toBe('1');
  });

  it('ignores target_uins for non-restricted visibility', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue(
      '{"code":0,"t1_tid":"FRIENDTID","t1_time":"1700000000"}',
    );

    await expect(publishQzoneMsg(cookies, '10000', 'friends', undefined, undefined, 4, 'not-a-uin')).resolves.toEqual({
      tid: 'FRIENDTID',
      time: 1700000000,
    });

    const [, , body] = spy.mock.calls[0]!;
    const form = new URLSearchParams(body as string);
    expect(form.get('ugc_right')).toBe('4');
    expect(form.has('allow_uins')).toBe(false);
  });

  it('falls back to tid/now for alternate client builds', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"tid":"ALT","now":1700000001}');
    await expect(publishQzoneMsg(cookies, '10000', 'hi')).resolves.toEqual({ tid: 'ALT', time: 1700000001 });
  });

  it('rejects empty content before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(publishQzoneMsg(cookies, '10000', '')).rejects.toThrow('content is required');
    expect(spy).not.toHaveBeenCalled();
  });

  it('rejects incomplete publish rich params before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(publishQzoneMsg(cookies, '10000', 'hi', 1)).rejects.toThrow('richType and richval');
    await expect(publishQzoneMsg(cookies, '10000', 'hi', undefined, ',123')).rejects.toThrow('richType and richval');
    expect(spy).not.toHaveBeenCalled();
  });

  it('rejects restricted visibility without target_uins before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(publishQzoneMsg(cookies, '10000', 'hi', undefined, undefined, 128)).rejects.toThrow('target_uins is required');
    expect(spy).not.toHaveBeenCalled();
  });

  it('throws on a non-zero qzone code (rejected/rate-limited)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":-10000,"message":"too frequent"}');
    await expect(publishQzoneMsg(cookies, '10000', 'hi')).rejects.toThrow('code=-10000');
  });

  it('throws when the success body carries no feed id (neither t1_tid nor tid)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"t1_time":"1700000000"}');
    await expect(publishQzoneMsg(cookies, '10000', 'hi')).rejects.toThrow('缺少 tid');
  });
});

describe('qzone / deleteQzoneMsg (HTTP layer)', () => {
  afterEach(() => vi.restoreAllMocks());

  it('POSTs the tid form body (format=fs) to the proxied delete CGI and resolves on code 0', async () => {
    // NB: the success-body shape is a guess extrapolated from sibling CGIs —
    // no public delete impl parses the response — so this mock pins our
    // success contract, not a verified server envelope (see helper comment).
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"subcode":0,"message":""}');

    await expect(deleteQzoneMsg(cookies, '10000', 'TID123')).resolves.toBeUndefined();

    const [url, method, body, headers] = spy.mock.calls[0]!;
    expect(method).toBe('POST');
    expect(url).toBe(
      `https://h5.qzone.qq.com/proxy/domain/taotao.qzone.qq.com/cgi-bin/emotion_cgi_delete_v6?g_tk=${expectedGtk}`,
    );
    const h = headers as Record<string, string>;
    expect(h['Content-Type']).toBe('application/x-www-form-urlencoded');
    expect(h.Cookie).toContain('p_skey=PSK');
    const form = new URLSearchParams(body as string);
    expect(form.get('tid')).toBe('TID123');
    expect(form.get('hostuin')).toBe('10000');
    // delete_v6 wants format=fs (NOT json), per the working community script
    expect(form.get('format')).toBe('fs');
    expect(form.get('json')).toBeNull(); // no bogus json param
  });

  it('rejects an empty tid before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(deleteQzoneMsg(cookies, '10000', '')).rejects.toThrow('tid is required');
    expect(spy).not.toHaveBeenCalled();
  });

  it('throws on a non-zero qzone code (foreign/unknown tid or auth failure)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":-4001,"message":"no permission"}');
    await expect(deleteQzoneMsg(cookies, '10000', 'TID123')).rejects.toThrow('code=-4001');
  });

  it('throws on a non-zero subcode even when code is 0', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"subcode":-12,"message":"sub error"}');
    await expect(deleteQzoneMsg(cookies, '10000', 'TID123')).rejects.toThrow('subcode=-12');
  });

  it('resolves when neither code nor subcode is present (extrapolated success branch)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"message":""}');
    await expect(deleteQzoneMsg(cookies, '10000', 'TID123')).resolves.toBeUndefined();
  });
});

describe('qzone / setQzoneLike (HTTP layer)', () => {
  afterEach(() => vi.restoreAllMocks());

  it('POSTs to internal_dolike_app with the mood unikey/curkey/fid/abstime when liking', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"subcode":0}');

    await expect(setQzoneLike(cookies, '10000', '20002', 'TIDX', true, 1700000000)).resolves.toBeUndefined();

    const [url, method, body, headers] = spy.mock.calls[0]!;
    expect(method).toBe('POST');
    // like CGI + unikey/curkey shape + opuin + appid CONFIRMED (QLiker.py, CSDN)
    expect(url).toBe(
      `https://h5.qzone.qq.com/proxy/domain/w.qzone.qq.com/cgi-bin/likes/internal_dolike_app?g_tk=${expectedGtk}`,
    );
    const h = headers as Record<string, string>;
    expect(h['Content-Type']).toBe('application/x-www-form-urlencoded');
    expect(h.Cookie).toContain('p_skey=PSK');
    const form = new URLSearchParams(body as string);
    // unikey/curkey address the target's 说说 (mood), fid is the tid, opuin is self
    expect(form.get('unikey')).toBe('http://user.qzone.qq.com/20002/mood/TIDX');
    expect(form.get('curkey')).toBe('http://user.qzone.qq.com/20002/mood/TIDX');
    expect(form.get('fid')).toBe('TIDX');
    expect(form.get('opuin')).toBe('10000');
    expect(form.get('appid')).toBe('311');
    // abstime threaded through (every real dolike impl sends it)
    expect(form.get('abstime')).toBe('1700000000');
  });

  it('defaults abstime to 0 when not supplied', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0}');
    await setQzoneLike(cookies, '10000', '20002', 'TIDX', true);
    const form = new URLSearchParams(spy.mock.calls[0]![2] as string);
    expect(form.get('abstime')).toBe('0');
  });

  it('hits internal_unlike_app when unliking (NB: unlike endpoint UNVERIFIED, pending a live capture)', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0}');
    await setQzoneLike(cookies, '10000', '10000', 'TIDX', false);
    const [url] = spy.mock.calls[0]!;
    expect(url).toContain('/cgi-bin/likes/internal_unlike_app?');
  });

  it('rejects an empty tid before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(setQzoneLike(cookies, '10000', '10000', '', true)).rejects.toThrow('tid is required');
    expect(spy).not.toHaveBeenCalled();
  });

  it('throws on a non-zero code (no permission / unknown tid)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":-3000,"message":"no perm"}');
    await expect(setQzoneLike(cookies, '10000', '20002', 'TIDX', true)).rejects.toThrow('like failed: code=-3000');
  });

  it('throws on a non-zero subcode too', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"subcode":-7}');
    await expect(setQzoneLike(cookies, '10000', '20002', 'TIDX', false)).rejects.toThrow('unlike failed: subcode=-7');
  });
});

describe('qzone / commentQzoneMsg (HTTP layer)', () => {
  afterEach(() => vi.restoreAllMocks());

  it('POSTs to re_feeds with the topicId/uin/hostUin/content and returns the comment id', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"commentid":987}');

    const out = await commentQzoneMsg(cookies, '10000', '20002', 'TIDX', '说得好 & 顶');

    expect(out).toEqual({ comment_id: '987' });

    const [url, method, body, headers] = spy.mock.calls[0]!;
    expect(method).toBe('POST');
    expect(url).toBe(
      `https://h5.qzone.qq.com/proxy/domain/taotao.qzone.qq.com/cgi-bin/emotion_cgi_re_feeds?g_tk=${expectedGtk}`,
    );
    const h = headers as Record<string, string>;
    expect(h['Content-Type']).toBe('application/x-www-form-urlencoded');
    expect(h.Cookie).toContain('p_skey=PSK');
    const form = new URLSearchParams(body as string);
    // topicId base <hostUin>_<tid> is confirmed; the __1 suffix is on 2/3
    // impls (one omits it) — kept as the default, not asserted as canonical.
    expect(form.get('topicId')).toBe('20002_TIDX__1');
    // uin=commenter(self), hostUin=feed owner — verified not-swapped
    expect(form.get('uin')).toBe('10000');
    expect(form.get('hostUin')).toBe('20002');
    expect(form.get('content')).toBe('说得好 & 顶');
    expect(form.get('format')).toBe('json');
    // qzreferrer carries the commenter's own space (matches the impls)
    expect(form.get('qzreferrer')).toBe('https://user.qzone.qq.com/10000');
    // the re_feeds param family (3/3 impls) the publish sibling also sends
    expect(form.get('feedsType')).toBe('100');
    expect(form.get('private')).toBe('0');
    expect(form.get('paramstr')).toBe('1');
  });

  it('threads image direct-url richval into the comment form', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"commentid":987}');
    const richval = 'https://example.qzone.qq.com/a.jpg\thttps://example.qzone.qq.com/b.jpg';

    await commentQzoneMsg(cookies, '10000', '20002', 'TIDX', 'pics', 1, richval);

    const form = new URLSearchParams(spy.mock.calls[0]![2] as string);
    expect(form.get('richtype')).toBe('1');
    expect(form.get('richval')).toBe(richval);
  });

  it('resolves with empty comment_id on success when the response carries no id (field name varies)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0}');
    await expect(commentQzoneMsg(cookies, '10000', '20002', 'TIDX', 'hi')).resolves.toEqual({ comment_id: '' });
  });

  it('reads the commentId (camelCase) fallback field', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":0,"commentId":"abc"}');
    await expect(commentQzoneMsg(cookies, '10000', '20002', 'TIDX', 'hi')).resolves.toEqual({ comment_id: 'abc' });
  });

  it('rejects empty tid or content before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(commentQzoneMsg(cookies, '10000', '20002', '', 'hi')).rejects.toThrow('tid is required');
    await expect(commentQzoneMsg(cookies, '10000', '20002', 'TIDX', '')).rejects.toThrow('content is required');
    expect(spy).not.toHaveBeenCalled();
  });

  it('rejects incomplete comment rich params before any request', async () => {
    const spy = vi.spyOn(RequestUtil, 'HttpGetText');
    await expect(commentQzoneMsg(cookies, '10000', '20002', 'TIDX', 'hi', 1)).rejects.toThrow('richType and richval');
    await expect(commentQzoneMsg(cookies, '10000', '20002', 'TIDX', 'hi', undefined, 'https://example.com/img.jpg')).rejects.toThrow('richType and richval');
    expect(spy).not.toHaveBeenCalled();
  });

  it('throws on a non-zero code (comments disabled / no permission)', async () => {
    vi.spyOn(RequestUtil, 'HttpGetText').mockResolvedValue('{"code":-3000,"message":"forbidden"}');
    await expect(commentQzoneMsg(cookies, '10000', '20002', 'TIDX', 'hi')).rejects.toThrow('comment failed: code=-3000');
  });
});