import { describe, expect, it } from "vitest";
import { matchAllowedOrigin, parseAllowedOrigins } from "./originCheck";

describe("parseAllowedOrigins", () => {
  it("splits CSV and trims whitespace", () => {
    expect(parseAllowedOrigins("https://a.example, https://b.example ,https://c.example")).toEqual([
      "https://a.example",
      "https://b.example",
      "https://c.example",
    ]);
  });
  it("returns [] for empty / null / undefined", () => {
    expect(parseAllowedOrigins("")).toEqual([]);
    expect(parseAllowedOrigins(null)).toEqual([]);
    expect(parseAllowedOrigins(undefined)).toEqual([]);
  });
  it("ignores empty entries from trailing commas", () => {
    expect(parseAllowedOrigins(",https://a.example,,")).toEqual(["https://a.example"]);
  });
});

describe("matchAllowedOrigin", () => {
  it("rejects null origin", () => {
    expect(matchAllowedOrigin(null, ["https://example.com"])).toBe(false);
  });
  it("rejects when allowlist is empty (fail-closed)", () => {
    expect(matchAllowedOrigin("https://example.com", [])).toBe(false);
  });
  it("rejects malformed origin", () => {
    expect(matchAllowedOrigin("not-a-url", ["https://example.com"])).toBe(false);
  });
  it("matches exact origin", () => {
    expect(matchAllowedOrigin("https://example.com", ["https://example.com"])).toBe(true);
  });
  it("ignores path/query on incoming origin", () => {
    expect(matchAllowedOrigin("https://example.com/page?x=1", ["https://example.com"])).toBe(true);
  });
  it("matches wildcard subdomain", () => {
    expect(matchAllowedOrigin("https://app.example.com", ["https://*.example.com"])).toBe(true);
    expect(matchAllowedOrigin("https://api.staging.example.com", ["https://*.example.com"])).toBe(false);
  });
  it("rejects different protocol", () => {
    expect(matchAllowedOrigin("http://example.com", ["https://example.com"])).toBe(false);
  });
  it("rejects different host", () => {
    expect(matchAllowedOrigin("https://attacker.com", ["https://example.com"])).toBe(false);
  });
});