import { describe, expect, it } from "vitest";
import { browserFrameSandbox, normalizeBrowserUrl } from "./browser-url";

describe("normalizeBrowserUrl", () => {
  it("defaults local dev servers to http and the web to https", () => {
    expect(normalizeBrowserUrl("localhost:5173")).toBe("http://localhost:5173/");
    expect(normalizeBrowserUrl("127.0.0.1:3000/app?x=1")).toBe("http://127.0.0.1:3000/app?x=1");
    expect(normalizeBrowserUrl("example.com/docs")).toBe("https://example.com/docs");
    expect(normalizeBrowserUrl("  https://example.com  ")).toBe("https://example.com/");
    expect(normalizeBrowserUrl("http://example.com")).toBe("http://example.com/");
  });

  it("rejects input that is not an http(s) address", () => {
    for (const input of [
      "",
      "hello world",
      "hello",
      "javascript:alert(1)",
      "file:///etc/passwd",
      "data:text/html,hi",
      "ftp://example.com",
      "https://user:fake-password@example.com",
    ]) {
      expect(normalizeBrowserUrl(input), input).toBeNull();
    }
  });
});

describe("browserFrameSandbox", () => {
  it("never grants same-origin access to the app's own origin", () => {
    expect(browserFrameSandbox("https://app.test/x", "https://app.test")).not.toContain(
      "allow-same-origin",
    );
    expect(browserFrameSandbox("http://localhost:5173/", "https://app.test")).toContain(
      "allow-same-origin",
    );
  });
});