import { afterEach, describe, expect, test } from "bun:test";
import { shouldUseSecureAuthCookie } from "./auth-cookie";

const ORIGINAL_ENV = {
  OVERLORD_AUTH_COOKIE_SECURE: process.env.OVERLORD_AUTH_COOKIE_SECURE,
  OVERLORD_TLS_OFFLOAD: process.env.OVERLORD_TLS_OFFLOAD,
  OVERLORD_TRUST_PROXY_HEADERS: process.env.OVERLORD_TRUST_PROXY_HEADERS,
};

afterEach(() => {
  for (const [key, value] of Object.entries(ORIGINAL_ENV)) {
    if (value === undefined) delete (process.env as any)[key];
    else (process.env as any)[key] = value;
  }
});

describe("shouldUseSecureAuthCookie", () => {
  test("does not trust X-Forwarded-Proto by default", () => {
    delete process.env.OVERLORD_AUTH_COOKIE_SECURE;
    delete process.env.OVERLORD_TLS_OFFLOAD;
    delete process.env.OVERLORD_TRUST_PROXY_HEADERS;

    const req = new Request("http://localhost/api/login", {
      headers: { "x-forwarded-proto": "https" },
    });

    expect(shouldUseSecureAuthCookie(req)).toBe(false);
  });

  test("treats TLS offload as externally secure without forwarded headers", () => {
    process.env.OVERLORD_TLS_OFFLOAD = "true";
    delete process.env.OVERLORD_TRUST_PROXY_HEADERS;
    delete process.env.OVERLORD_AUTH_COOKIE_SECURE;

    const req = new Request("http://localhost/api/login");

    expect(shouldUseSecureAuthCookie(req)).toBe(true);
  });

  test("trusts X-Forwarded-Proto when proxy headers are explicitly trusted", () => {
    process.env.OVERLORD_TRUST_PROXY_HEADERS = "true";
    delete process.env.OVERLORD_TLS_OFFLOAD;
    delete process.env.OVERLORD_AUTH_COOKIE_SECURE;

    const req = new Request("http://localhost/api/login", {
      headers: { "x-forwarded-proto": "https" },
    });

    expect(shouldUseSecureAuthCookie(req)).toBe(true);
  });

  test("honors explicit secure override", () => {
    process.env.OVERLORD_AUTH_COOKIE_SECURE = "true";
    const req = new Request("http://localhost/api/login");
    expect(shouldUseSecureAuthCookie(req)).toBe(true);
  });
});