import { expect, test } from 'bun:test';
import type { RequestEvent } from '@sveltejs/kit';
import { handle } from '../src/hooks.server';
import { assertSameOrigin } from '../src/lib/server/security';

async function headers(path: string) {
  const response = await handle({
    event: { url: new URL(path, 'https://app.example') } as RequestEvent,
    resolve: async () => new Response('ok'),
  });
  return response.headers;
}

test('app pages preserve native form Origin without sharing cross-origin referrers', async () => {
  for (const path of ['/', '/characters', '/assets']) {
    const result = await headers(path);
    expect(result.get('referrer-policy')).toBe('same-origin');
    expect(result.get('cache-control')).toBe('no-store');
    expect(result.get('x-content-type-options')).toBe('nosniff');
  }
});

test('OAuth initiation and callback URLs remain no-referrer', async () => {
  for (const path of ['/auth/eve', '/auth/eve/callback?code=test-only&state=test-only', '/auth/logout']) {
    expect((await headers(path)).get('referrer-policy')).toBe('no-referrer');
  }
});

test('origin protection still rejects null, absent, and foreign origins', () => {
  const expected = 'https://app.example';
  for (const origin of [undefined, 'null', 'https://foreign.example']) {
    const request = new Request(`${expected}/auth/eve`, { method: 'POST', headers: origin ? { origin } : {} });
    expect(() => assertSameOrigin(request, expected)).toThrow();
  }
  expect(() => assertSameOrigin(new Request(`${expected}/auth/eve`, { method: 'POST', headers: { origin: expected } }), expected)).not.toThrow();
});