import { describe, it, expect } from "vitest";
import { enforceAuthCors } from "../lib/auth-cors.js";

const TRUSTED = ["https://uat.groombook.dev", "https://dev.groombook.dev"];

/** Simulates Better Auth reflecting the request Origin (the pre-fix bug). */
function makeReflectedResponse(origin: string | null): Response {
  return new Response('{"ok":true}', {
    status: 200,
    headers: {
      "Content-Type": "application/json",
      ...(origin
        ? {
            "Access-Control-Allow-Origin": origin,
            "Access-Control-Allow-Credentials": "true",
          }
        : {}),
    },
  });
}

describe("enforceAuthCors (GRO-2586)", () => {
  it("passes trusted origin through with credentials", () => {
    const origin = "https://uat.groombook.dev";
    const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin));
    expect(res.headers.get("Access-Control-Allow-Origin")).toBe(origin);
    expect(res.headers.get("Access-Control-Allow-Credentials")).toBe("true");
  });

  it("strips ACAO for attacker origin (credentialed cross-origin read blocked)", () => {
    const origin = "https://evil.example.com";
    const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin));
    expect(res.headers.get("Access-Control-Allow-Origin")).toBeNull();
    expect(res.headers.get("Access-Control-Allow-Credentials")).toBeNull();
  });

  it("strips ACAO when no Origin header (undefined)", () => {
    const res = enforceAuthCors(undefined, TRUSTED, makeReflectedResponse(null));
    expect(res.headers.get("Access-Control-Allow-Origin")).toBeNull();
    expect(res.headers.get("Access-Control-Allow-Credentials")).toBeNull();
  });

  it("preserves non-CORS response headers and status from Better Auth", () => {
    const origin = "https://evil.example.com";
    const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin));
    expect(res.headers.get("Content-Type")).toBe("application/json");
    expect(res.status).toBe(200);
  });

  it("second trusted origin is also allowed", () => {
    const origin = "https://dev.groombook.dev";
    const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin));
    expect(res.headers.get("Access-Control-Allow-Origin")).toBe(origin);
  });

  it("empty string origin is treated as untrusted", () => {
    const res = enforceAuthCors("", TRUSTED, makeReflectedResponse(""));
    expect(res.headers.get("Access-Control-Allow-Origin")).toBeNull();
  });
});