import { expect, test } from "bun:test";
import { withSecurityHeaders } from "../src/headers.ts";
test("explicit response resource policies survive defaults while configured application policy wins", () => {
  const req = new Request("https://example.com/image.png");
  const image = () =>
    new Response("image", {
      headers: { "Cross-Origin-Resource-Policy": "cross-origin", "Content-Type": "image/png" },
    });
  expect(
    withSecurityHeaders(req, image(), "production").headers.get("Cross-Origin-Resource-Policy"),
  ).toBe("cross-origin");
  expect(
    withSecurityHeaders(req, new Response("private"), "production").headers.get(
      "Cross-Origin-Resource-Policy",
    ),
  ).toBe("same-origin");
  expect(
    withSecurityHeaders(req, image(), "production", {
      crossOriginResourcePolicy: "same-origin",
    }).headers.get("Cross-Origin-Resource-Policy"),
  ).toBe("same-origin");
  expect(
    withSecurityHeaders(
      req,
      new Response("x", { headers: { "Cross-Origin-Resource-Policy": "invalid" } }),
      "production",
    ).headers.get("Cross-Origin-Resource-Policy"),
  ).toBe("same-origin");
});