import { describe, expect, it } from "vitest";

import { CSP_NONCE_REQUEST_HEADER } from "../apps/web/app/utils/security/contentSecurityPolicy";
import { createRequestCspNonce, overwriteRequestCspNonce } from "./csp";

describe("request CSP nonce", () => {
  it("creates a cryptographically random nonce for every request", () => {
    const nonces = new Set(Array.from({ length: 64 }, () => createRequestCspNonce()));

    expect(nonces.size).toBe(64);
    for (const nonce of nonces) {
      expect(nonce).toMatch(/^[A-Za-z0-9_-]{24}$/u);
    }
  });

  it("overwrites a spoofed incoming internal header", () => {
    const headers = new Headers({ [CSP_NONCE_REQUEST_HEADER]: "attacker-controlled" });
    const trustedNonce = "aBcDeFgHiJkLmNoPqRsTuVwX";

    expect(overwriteRequestCspNonce(headers, trustedNonce)).toBe(trustedNonce);
    expect(headers.get(CSP_NONCE_REQUEST_HEADER)).toBe(trustedNonce);
  });
});