package main

import (
	"net/netip"
	"strings"
	"testing"
)

func TestBoundaries(t *testing.T) {
	raw, safe, err := render()
	if err != nil || raw != "<p><b>guest</b></p>" || safe != "<p>&lt;b&gt;guest&lt;/b&gt;</p>" {
		t.Fatal(raw, safe, err)
	}
	dot, link, err := pathChecks()
	if err != nil || !dot || !link {
		t.Fatal(dot, link, err)
	}
	blocked, hits, err := redirectChecks()
	if err != nil || !blocked || hits != 0 {
		t.Fatal(blocked, hits, err)
	}
	arg, err := literalArg()
	if err != nil || arg != "hello; printf INJECTED" {
		t.Fatal(arg, err)
	}
}
func TestTargetPolicy(t *testing.T) {
	good := []netip.Addr{netip.MustParseAddr("192.0.2.10")}
	for _, raw := range []string{"http://assets.example/a", "https://assets.example:444/a", "https://assets.example.other/a", "https://user@assets.example/a", "https://127.0.0.1/a", "https://assets.example/a#fragment"} {
		if allowedTarget(raw, good) {
			t.Fatal("accepted", raw)
		}
	}
	if allowedTarget("https://assets.example", nil) {
		t.Fatal("empty DNS")
	}
	if allowedTarget("https://assets.example", append(good, netip.MustParseAddr("::1"))) {
		t.Fatal("mixed DNS")
	}
}
func TestInputAndCSRF(t *testing.T) {
	if decode(`{"name":"ok"}`) != nil {
		t.Fatal("valid rejected")
	}
	for _, raw := range []string{`{"name":"a","role":"admin"}`, `{"name":"a"}{}`, `{"name":""}`, strings.Repeat("x", 129)} {
		if decode(raw) == nil {
			t.Fatal("accepted", raw)
		}
	}
	token := strings.Repeat("t", 32)
	if !csrfAllowed("https://app.example", token, token) || csrfAllowed("https://app.example", "", token) || csrfAllowed("", token, token) {
		t.Fatal("csrf")
	}
	if p, ok := destination("account"); !ok || p != "/account" {
		t.Fatal("redirect")
	}
}