import { INestApplication } from '@nestjs/common';
import request from 'supertest';
import { App } from 'supertest/types';
import { createTestApp } from './utils/create-test-app';

describe('Security headers (e2e)', () => {
  let app: INestApplication<App>;

  beforeAll(async () => {
    app = await createTestApp();
  });

  afterAll(async () => {
    await app.close();
  });

  it('marks API answers no-store, unframeable and without an ETag', async () => {
    const response = await request(app.getHttpServer())
      .get('/api/v1/auth/sso/status')
      .expect(200);

    expect(response.headers['cache-control']).toBe('no-store');
    expect(response.headers['content-security-policy']).toContain(
      "default-src 'none'",
    );
    expect(response.headers['content-security-policy']).toContain(
      "frame-ancestors 'none'",
    );
    expect(response.headers['etag']).toBeUndefined();
    expect(response.headers['x-powered-by']).toBeUndefined();
  });

  it('rate-limits requests with a wrong API key like any other', async () => {
    const server = app.getHttpServer();
    const statuses: number[] = [];
    for (let i = 0; i < 105 && !statuses.includes(429); i++) {
      const response = await request(server)
        .get('/api/v1/shop-sync')
        .set('Authorization', `Bearer ack_aaaaaaaa_${'A'.repeat(43)}`);
      statuses.push(response.status);
    }
    expect(statuses).toContain(429);
  });
});