import { describe, expect, it } from 'vitest'
import { safeHttpUrl } from './safe-url'

describe('safeHttpUrl', () => {
  it.each([
    ['javascript:alert(1)'],
    ['JaVaScRiPt:alert(1)'],
    [' javascript:alert(1)'],
    [' javascript:alert(1)'],
    ['java\tscript:alert(1)'],
    ['java\nscript:alert(1)'],
    ['data:text/html,<script>alert(1)</script>'],
    ['vbscript:msgbox(1)'],
    ['//evil.tld/phish'],
    [''],
  ])('rejects %s', (value) => {
    expect(safeHttpUrl(value)).toBeUndefined()
  })

  it('accepts a valid absolute https URL', () => {
    expect(safeHttpUrl('https://overdeck.example/proof/1')).toBe('https://overdeck.example/proof/1')
  })

  it('accepts a valid absolute http URL', () => {
    expect(safeHttpUrl('http://overdeck.example/proof/1')).toBe('http://overdeck.example/proof/1')
  })

  it('accepts a same-origin relative path', () => {
    expect(safeHttpUrl('/plans/123')).toBe('/plans/123')
  })

  it('accepts a query-only relative target', () => {
    expect(safeHttpUrl('?tab=x')).toBe('?tab=x')
  })

  it('accepts a fragment-only relative target', () => {
    expect(safeHttpUrl('#main')).toBe('#main')
  })

  it('returns undefined for null', () => {
    expect(safeHttpUrl(null)).toBeUndefined()
  })

  it('returns undefined for undefined', () => {
    expect(safeHttpUrl(undefined)).toBeUndefined()
  })
})