'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const {
  canonicalizeAltaOrigin,
  isAltaOrigin,
} = require('../src/url-policy');

test('accepts and canonicalizes HTTPS Alta deployment subdomains', () => {
  assert.equal(canonicalizeAltaOrigin('https://Example.AVASECURITY.com/'), 'https://example.avasecurity.com');
  assert.equal(canonicalizeAltaOrigin('https://edge.eu.avigilon.com:443'), 'https://edge.eu.avigilon.com');
  assert.equal(isAltaOrigin('https://tenant.avasecurity.com'), true);
});

test('rejects roots, lookalikes, HTTP, and arbitrary exfiltration destinations', () => {
  for (const value of [
    'https://avasecurity.com',
    'https://avigilon.com',
    'https://avasecurity.com.evil.example',
    'https://tenant.avasecurity.com.evil.example',
    'https://evilavasecurity.com',
    'http://tenant.avasecurity.com',
    'https://example.com',
    'file:///etc/passwd',
  ]) {
    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
  }
});

test('rejects authority tricks, fragments, paths, queries and non-default ports', () => {
  for (const value of [
    'https://user:pass@tenant.avasecurity.com',
    'https://tenant.avasecurity.com/#fragment',
    'https://tenant.avasecurity.com/api/v1/devices',
    'https://tenant.avasecurity.com?next=https://evil.example',
    'https://tenant.avasecurity.com:8443',
    'https://tenant.avasecurity.com\\@evil.example',
  ]) {
    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
  }
});

test('rejects CRLF, whitespace, non-strings, oversized and malformed values', () => {
  for (const value of [
    'https://tenant.avasecurity.com\r\nX-Test: injected',
    ' https://tenant.avasecurity.com',
    'https://tenant.avasecurity.com ',
    'not a URL',
    '',
    null,
    7,
    `https://${'a'.repeat(513)}.avasecurity.com`,
  ]) {
    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, String(value));
  }
});