import { expect, test } from "bun:test";
import { withSecurityHeaders } from "../src/headers.ts";
const request = new Request("https://app.example.test/");
const policy =
  "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors https://customer.example.test; sandbox";
test("route CSP does not override the default without explicit application opt-in", () => {
  const response = withSecurityHeaders(
    request,
    new Response("static", { headers: { "content-security-policy": policy } }),
    "production",
  );
  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
  expect(response.headers.get("x-frame-options")).toBe("SAMEORIGIN");
});
test("trusted static routes retain strict CSP and explicit cross-origin framing when enabled", () => {
  const response = withSecurityHeaders(
    request,
    new Response("static", { headers: { "content-security-policy": policy } }),
    "production",
    { routeContentSecurityPolicy: true },
  );
  expect(response.headers.get("content-security-policy")).toBe(policy);
  expect(response.headers.has("x-frame-options")).toBe(false);
  expect(response.headers.get("x-content-type-options")).toBe("nosniff");
  expect(response.headers.get("strict-transport-security")).toContain("max-age=");
});
test("ordinary routes keep defaults and a route without frame-ancestors keeps frame restrictions", () => {
  const ordinary = withSecurityHeaders(request, new Response("app"), "production", {
    routeContentSecurityPolicy: true,
  });
  expect(ordinary.headers.get("content-security-policy")).toContain("default-src 'self'");
  expect(ordinary.headers.get("x-frame-options")).toBe("SAMEORIGIN");
  const staticResponse = withSecurityHeaders(
    request,
    new Response("static", {
      headers: { "content-security-policy": "default-src 'none'; sandbox" },
    }),
    "production",
    { routeContentSecurityPolicy: true },
  );
  expect(staticResponse.headers.get("content-security-policy")).toBe("default-src 'none'; sandbox");
  expect(staticResponse.headers.get("x-frame-options")).toBe("SAMEORIGIN");
});