// @vitest-environment jsdom
import { describe, expect, it } from "vitest";

import { getCurrentDocumentCspNonce } from "./documentCspNonce";

describe("document CSP nonce", () => {
  it("reads the browser nonce property from a trusted document script", () => {
    const script = document.createElement("script");
    script.nonce = "aBcDeFgHiJkLmNoPqRsTuVwX";
    document.head.appendChild(script);

    expect(getCurrentDocumentCspNonce(document)).toBe(script.nonce);
    script.remove();
  });

  it("ignores malformed nonce attributes", () => {
    const script = document.createElement("script");
    script.nonce = "spoofed";
    document.head.appendChild(script);

    expect(getCurrentDocumentCspNonce(document)).toBeUndefined();
    script.remove();
  });
});