import { expect, test } from "bun:test";
import { validateRpcCsrf } from "../src/index.ts";

function request(headers: Record<string, string> = {}): Request {
  return new Request("https://app.example/__wrnexus/rpc", {
    method: "POST",
    headers,
  });
}

test("RPC CSRF requires a matching cookie and header from the same origin", () => {
  expect(validateRpcCsrf(request())).toBe(false);
  expect(validateRpcCsrf(request({ cookie: "wrn-csrf=token" }))).toBe(false);
  expect(validateRpcCsrf(request({ "x-csrf-token": "token" }))).toBe(false);
  expect(validateRpcCsrf(request({ cookie: "wrn-csrf=token", "x-csrf-token": "forged" }))).toBe(
    false,
  );
  expect(
    validateRpcCsrf(
      request({
        cookie: "wrn-csrf=token",
        "x-csrf-token": "token",
        origin: "https://evil.example",
      }),
    ),
  ).toBe(false);
  expect(
    validateRpcCsrf(
      request({
        cookie: "wrn-csrf=encoded%20token",
        "x-csrf-token": "encoded token",
        origin: "https://app.example",
      }),
    ),
  ).toBe(true);
});