package middleware

import (
	"log/slog"
	"net/http"
	"net/http/httptest"
	"testing"

	"git.avsdev.uk/Go/job-search/internal/config"
)

func TestCrossOriginRejected(t *testing.T) {
	var cfg config.JSCServerCSRF
	cfg.CrossOriginProtection.Enabled = true
	c, err := NewCSRF(cfg, WithLogger(slog.New(slog.DiscardHandler)))
	if err != nil {
		t.Fatal(err)
	}
	h := c.Protect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
	}))
	wants := map[string]int{
		"cross-site":  http.StatusForbidden,
		"same-origin": http.StatusOK,
	}
	for site, want := range wants {
		req := httptest.NewRequest("POST", "/api/items", nil)
		req.Header.Set("Sec-Fetch-Site", site)
		rec := httptest.NewRecorder()
		h.ServeHTTP(rec, req)
		if rec.Code != want {
			t.Errorf("%s: got %d, want %d", site, rec.Code, want)
		}
	}
}