import { expect, test } from "bun:test";
import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { servePublicAsset } from "../src/public.ts";

test("production HTML revalidates while fingerprinted assets are immutable", async () => {
  const root = mkdtempSync(join(tmpdir(), "wrnexus-public-"));
  mkdirSync(join(root, "assets"));
  writeFileSync(join(root, "index.html"), "home");
  writeFileSync(join(root, "assets", "app.abcdef1234.js"), "app");
  writeFileSync(join(root, "brand.woff2"), "font");
  const html = await servePublicAsset(root, "/index.html", "production");
  const asset = await servePublicAsset(root, "/assets/app.abcdef1234.js", "production");
  const font = await servePublicAsset(root, "/brand.woff2", "production");
  expect(html?.headers.get("cache-control")).toBe("public, max-age=0, must-revalidate");
  expect(asset?.headers.get("cache-control")).toBe("public, max-age=31536000, immutable");
  expect(asset?.headers.get("x-content-type-options")).toBe("nosniff");
  expect(font?.headers.get("cache-control")).toBe("public, max-age=31536000, immutable");
});

test("public server rejects encoded traversal", async () => {
  const root = mkdtempSync(join(tmpdir(), "wrnexus-public-"));
  expect(await servePublicAsset(root, "/%2e%2e/secret", "production")).toBeNull();
});