import { describe, expect, it } from 'vitest';
import { isSameOriginRequest } from './same-origin';

const ORIGINS = ['https://pintrush.com'];

describe('isSameOriginRequest', () => {
  it('trusts Sec-Fetch-Site when the browser sends it', () => {
    expect(isSameOriginRequest(new Headers({ 'sec-fetch-site': 'same-origin' }), ORIGINS)).toBe(true);
    for (const site of ['cross-site', 'same-site', 'none']) {
      // Even with a matching Origin: the browser's own verdict wins.
      expect(isSameOriginRequest(new Headers({ 'sec-fetch-site': site, origin: 'https://pintrush.com' }), ORIGINS)).toBe(false);
    }
  });

  it('falls back to Origin, and refuses when neither header is present', () => {
    expect(isSameOriginRequest(new Headers({ origin: 'https://pintrush.com' }), ORIGINS)).toBe(true);
    expect(isSameOriginRequest(new Headers({ origin: 'https://evil.example' }), ORIGINS)).toBe(false);
    expect(isSameOriginRequest(new Headers({ origin: 'null' }), ORIGINS)).toBe(false);
    expect(isSameOriginRequest(new Headers(), ORIGINS)).toBe(false);
  });
});