import { describe, expect, it } from 'vitest' import { addReturnTo, buildNotificationActionPath, getSafeReturnTo, isSafeInternalNavigationPath } from '@/lib/notificationNavigation' describe('notification navigation policy', () => { it('adds the notifications return path while preserving destination query parameters', () => { expect(buildNotificationActionPath('/my-events/event-1/manage?tab=attendance')).toBe( '/my-events/event-1/manage?tab=attendance&returnTo=%2Fprofile%2Fnotifications' ) }) it.each(['https://example.com/path', '//example.com/path', '/\\example.com/path'])('rejects an unsafe or external path: %s', (path) => { expect(isSafeInternalNavigationPath(path)).toBe(false) expect(buildNotificationActionPath(path)).toBeNull() }) it('only returns a safe internal return destination', () => { expect(getSafeReturnTo('?returnTo=%2Fprofile%2Fnotifications')).toBe('/profile/notifications') expect(getSafeReturnTo('?returnTo=%2F%2Fexample.com')).toBeNull() }) it('does not append an unsafe return destination', () => { expect(addReturnTo('/bookings/1', '//example.com')).toBeNull() }) })