import { describe, test, expect } from "vitest";
import { isTrustedOrigin } from "./csrf";

function makeRequest(url: string, origin?: string): Request {
  const headers = new Headers();
  if (origin !== undefined) headers.set("origin", origin);
  return new Request(url, { method: "POST", headers });
}

describe("isTrustedOrigin", () => {
  test("accepts a same-origin request", () => {
    const request = makeRequest("https://wabenhain.com/api/checkout", "https://wabenhain.com");
    expect(isTrustedOrigin(request)).toBe(true);
  });

  test("accepts a same-origin request even with an explicit default port in the URL", () => {
    const request = makeRequest("https://wabenhain.com:443/api/checkout", "https://wabenhain.com");
    expect(isTrustedOrigin(request)).toBe(true);
  });

  test("rejects a cross-origin request (forged CSRF attempt)", () => {
    const request = makeRequest("https://wabenhain.com/api/checkout", "https://attacker.example");
    expect(isTrustedOrigin(request)).toBe(false);
  });

  test("rejects a cross-origin request even from a similarly named host", () => {
    const request = makeRequest("https://wabenhain.com/api/checkout", "https://wabenhain.com.attacker.example");
    expect(isTrustedOrigin(request)).toBe(false);
  });

  test("rejects a malformed Origin header instead of throwing", () => {
    const request = makeRequest("https://wabenhain.com/api/checkout", "not-a-valid-url");
    expect(isTrustedOrigin(request)).toBe(false);
  });

  test("allows a request with no Origin header (e.g. server-to-server calls)", () => {
    const request = makeRequest("https://wabenhain.com/api/checkout");
    expect(isTrustedOrigin(request)).toBe(true);
  });
});