from app.native.wndb import s2_junctions


def test_get_junction_binds_untrusted_identifier(monkeypatch) -> None:
    calls: list[tuple[str, str, tuple[str, ...]]] = []
    malicious_id = "J-1'; DELETE FROM junctions; --"

    def fake_try_read(name, statement, params):
        calls.append((name, statement, params))
        return None

    monkeypatch.setattr(s2_junctions, "try_read", fake_try_read)

    assert s2_junctions.get_junction("project_a", malicious_id) == {}
    assert calls == [
        (
            "project_a",
            "select * from junctions where id = %s",
            (malicious_id,),
        )
    ]