import { describe, expect, it } from 'vitest'
import { assertAllowedMenuUrl, MenuUrlSchemeError } from './index.js'

describe('assertAllowedMenuUrl (public barrel)', () => {
  it('accepts http/https/mailto and safe path-relative URLs', () => {
    expect(assertAllowedMenuUrl('https://x/y')).toBe('https://x/y')
    expect(assertAllowedMenuUrl('http://x')).toBe('http://x')
    expect(assertAllowedMenuUrl('/rel/path')).toBe('/rel/path')
    expect(assertAllowedMenuUrl('mailto:a@b.com')).toBe('mailto:a@b.com')
  })

  it('returns trimmed and control-char-stripped canonical form', () => {
    expect(assertAllowedMenuUrl('  https://x/y  ')).toBe('https://x/y')
    expect(assertAllowedMenuUrl('\u0000https://x\u001F')).toBe('https://x')
    expect(assertAllowedMenuUrl('  /rel/path  ')).toBe('/rel/path')
  })

  it('rejects dangerous schemes and open-redirect path forms', () => {
    for (const url of [
      'javascript:alert(1)',
      'data:text/html,x',
      '//evil.com',
      '/\\evil.com',
      '  JavaScript:alert(1)',
    ]) {
      expect(() => assertAllowedMenuUrl(url)).toThrow(MenuUrlSchemeError)
    }
  })
})