import { describe, it, expect } from 'vitest'
import { assertCsrf, CsrfError } from './csrf.js'

describe('assertCsrf', () => {
  it('passes a same-origin session request', () => {
    const req = new Request('https://cms.example/api/admin/content', {
      method: 'POST', headers: { origin: 'https://cms.example', cookie: 'mod_session=x' },
    })
    expect(() => assertCsrf(req, { authMode: 'session', siteOrigin: 'https://cms.example' })).not.toThrow()
  })
  it('rejects a cross-origin session request', () => {
    const req = new Request('https://cms.example/api/admin/content', {
      method: 'POST', headers: { origin: 'https://evil.test', cookie: 'mod_session=x' },
    })
    expect(() => assertCsrf(req, { authMode: 'session', siteOrigin: 'https://cms.example' })).toThrow(CsrfError)
  })
  it('is a no-op for token-bearer requests (CSRF-exempt)', () => {
    const req = new Request('https://cms.example/api/admin/content', { method: 'POST', headers: { origin: 'https://evil.test' } })
    expect(() => assertCsrf(req, { authMode: 'token', siteOrigin: 'https://cms.example' })).not.toThrow()
  })
  it('rejects a session request with NO Origin header (fail-closed)', () => {
    const req = new Request('https://cms.example/api/admin/content', { method: 'POST', headers: { cookie: 'mod_session=x' } })
    expect(() => assertCsrf(req, { authMode: 'session', siteOrigin: 'https://cms.example' })).toThrow(CsrfError)
  })
})