import { describe, test, expect } from "vitest";
import { redirectWithinSite } from "./redirect";

describe("redirectWithinSite", () => {
  test("setzt einen relativen Location-Header statt einer absoluten Domain", () => {
    const response = redirectWithinSite("/konto");
    expect(response.status).toBe(307);
    expect(response.headers.get("location")).toBe("/konto");
  });

  test("behaelt Query-Parameter bei", () => {
    const response = redirectWithinSite("/newsletter-bestaetigt?status=ok");
    expect(response.headers.get("location")).toBe("/newsletter-bestaetigt?status=ok");
  });

  test("laesst sich mit Cookies (Flash-Meldung) versehen", () => {
    const response = redirectWithinSite("/konto");
    response.cookies.set("probe", "1");
    expect(response.headers.get("set-cookie")).toContain("probe=1");
  });

  test.each(["https://evil.example/konto", "//evil.example/konto", "konto", "/\\evil.example"])(
    "lehnt %s ab (keine offene Weiterleitung)",
    (target) => {
      expect(() => redirectWithinSite(target)).toThrow();
    }
  );
});