import { expect, test } from "bun:test";
import { withSecurityHeaders } from "../src/headers.ts";
test("default framing permits self but not cross-origin ancestors", () => {
  const headers = withSecurityHeaders(
    new Request("https://app.test"),
    new Response("ok"),
    "production",
  ).headers;
  expect(headers.get("x-frame-options")).toBe("SAMEORIGIN");
  expect(headers.get("content-security-policy")).toContain("frame-ancestors 'self'");
});
test("explicit DENY keeps both framing policies restrictive", () => {
  const headers = withSecurityHeaders(
    new Request("https://app.test"),
    new Response("ok"),
    "production",
    { frameOptions: "DENY" },
  ).headers;
  expect(headers.get("x-frame-options")).toBe("DENY");
  expect(headers.get("content-security-policy")).toContain("frame-ancestors 'none'");
});