package httpx

import (
	"net/http/httptest"
	"strings"
	"testing"
)

func TestSecure(t *testing.T) {
	rec := httptest.NewRecorder()
	Secure(rec, SecureOptions{ScriptSrc: "'self'", NoStore: true})
	h := rec.Header()

	if got := h.Get("X-Content-Type-Options"); got != "nosniff" {
		t.Errorf("X-Content-Type-Options = %q", got)
	}
	if got := h.Get("X-Frame-Options"); got != "DENY" {
		t.Errorf("X-Frame-Options = %q", got)
	}
	if got := h.Get("Cache-Control"); got != "no-store" {
		t.Errorf("Cache-Control = %q", got)
	}
	if got := h.Get("Content-Security-Policy"); got == "" ||
		!strings.Contains(got, "script-src 'self'") || !strings.Contains(got, "base-uri 'none'") {
		t.Errorf("Content-Security-Policy = %q", got)
	}
}

func TestSecureDefaultsToNoScript(t *testing.T) {
	rec := httptest.NewRecorder()
	Secure(rec, SecureOptions{})
	if got := rec.Header().Get("Content-Security-Policy"); !strings.Contains(got, "script-src 'none'") {
		t.Errorf("Content-Security-Policy = %q, want script-src 'none'", got)
	}
	if got := rec.Header().Get("Cache-Control"); got != "" {
		t.Errorf("Cache-Control = %q, want unset", got)
	}
}

func TestSameOrigin(t *testing.T) {
	cases := []struct {
		name   string
		fetch  string
		origin string
		want   bool
	}{
		{name: "no headers", want: true},
		{name: "same origin", fetch: "same-origin", origin: "https://git.example", want: true},
		{name: "cross site", fetch: "cross-site", want: false},
		{name: "different origin", origin: "https://evil.example", want: false},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			r := httptest.NewRequest("POST", "https://git.example/admin/notices", nil)
			if tc.fetch != "" {
				r.Header.Set("Sec-Fetch-Site", tc.fetch)
			}
			if tc.origin != "" {
				r.Header.Set("Origin", tc.origin)
			}
			if got := SameOrigin(r); got != tc.want {
				t.Fatalf("SameOrigin() = %v, want %v", got, tc.want)
			}
		})
	}
}

func TestIsHTTPSAndAbsoluteURL(t *testing.T) {
	r := httptest.NewRequest("GET", "http://git.example/share/new", nil)
	r.Host = "git.example"
	if IsHTTPS(r) {
		t.Fatal("plain request reported HTTPS")
	}
	if got := AbsoluteURL(r, "/share/view/token"); got != "http://git.example/share/view/token" {
		t.Fatalf("AbsoluteURL() = %q", got)
	}

	r.Header.Set("X-Forwarded-Proto", "https")
	if !IsHTTPS(r) {
		t.Fatal("proxied HTTPS request not recognized")
	}
	if got := AbsoluteURL(r, "/share/view/token"); got != "https://git.example/share/view/token" {
		t.Fatalf("AbsoluteURL() = %q", got)
	}
}

func TestRemoteIP(t *testing.T) {
	r := httptest.NewRequest("GET", "/", nil)
	r.RemoteAddr = "203.0.113.9:54321"
	if got := RemoteIP(r); got != "203.0.113.9" {
		t.Fatalf("RemoteIP() = %q", got)
	}
	r.RemoteAddr = "unix"
	if got := RemoteIP(r); got != "unix" {
		t.Fatalf("RemoteIP() = %q", got)
	}
}