import { describe, expect, it } from "vitest";
import { requestWebOrigin } from "./web-origin.js";

const configured = "http://127.0.0.1:5173";

describe("requestWebOrigin", () => {
  it("follows a browser on loopback or a private network", () => {
    expect(requestWebOrigin("http://192.168.0.20:5173", configured)).toBe(
      "http://192.168.0.20:5173",
    );
    expect(requestWebOrigin("http://10.0.0.5:5173", configured)).toBe("http://10.0.0.5:5173");
    expect(requestWebOrigin("http://mac.local:5173", configured)).toBe("http://mac.local:5173");
    expect(requestWebOrigin("http://localhost:5173", configured)).toBe("http://localhost:5173");
  });

  it("keeps WEB_ORIGIN for public hosts, other schemes, and missing origins", () => {
    expect(requestWebOrigin("https://attacker.example", configured)).toBe(configured);
    expect(requestWebOrigin("rakazo://app", configured)).toBe(configured);
    expect(requestWebOrigin("null", configured)).toBe(configured);
    expect(requestWebOrigin(undefined, configured)).toBe(configured);
  });

  it("accepts the configured origin even when it is public", () => {
    expect(requestWebOrigin("https://evoo.example", "https://evoo.example")).toBe(
      "https://evoo.example",
    );
  });
});