import { describe, it, expect, beforeEach } from 'vitest'
import { runSecurityPipeline, _resetVelocityMap } from './index.js'

describe('runSecurityPipeline', () => {
  beforeEach(() => {
    _resetVelocityMap()
  })

  it('merges codes and vetoes setCookie when any guardrail blocks', () => {
    const result = runSecurityPipeline({
      ipHash: 'deadbeefcafebabe',
      refererUrl: '',
      userAgent: 'Mozilla/5.0',
      country: 'US',
      secFetch: { secFetchMode: 'cors', secFetchDest: 'empty', secFetchSite: 'cross-site' },
      settings: {
        brandKeywordBlocklist: [],
        disallowedRefererHosts: [],
        couponDomains: [],
        allowedCountries: ['IL'],
      },
    })

    expect(result.setCookie).toBe(false)
    expect(result.isSuspicious).toBe(true)
    expect(result.codes).toContain('COOKIE_STUFFING')
    expect(result.codes).toContain('NO_REFERER')
    expect(result.codes).toContain('GEO_OUT_OF_RANGE')
  })
})