import { describe, expect, it } from 'vitest'

import { CLEAR_REFRESH_SESSION_HEADER, REFRESH_TOKEN_COOKIE_DEV, REFRESH_TOKEN_COOKIE_HOST } from '@/lib/refreshSessionCookie'

import { POST } from './route'

describe('POST /api/auth/clear-session', () => {
  it('rejects requests without the logout header', () => {
    const response = POST(new Request('http://127.0.0.1/api/auth/clear-session', { method: 'POST' }))

    expect(response.status).toBe(403)
    expect(response.headers.getSetCookie()).toEqual([])
  })

  it('expires both Nest refresh cookie names when the header is present', () => {
    const response = POST(
      new Request('http://127.0.0.1/api/auth/clear-session', {
        method: 'POST',
        headers: { [CLEAR_REFRESH_SESSION_HEADER]: '1' },
      })
    )
    const cookies = response.headers.getSetCookie()

    expect(response.status).toBe(200)
    expect(response.headers.get('Cache-Control')).toBe('no-store')
    expect(cookies).toHaveLength(3)
    expect(cookies.some((cookie) => cookie.startsWith(`${REFRESH_TOKEN_COOKIE_DEV}=`) && cookie.includes('Max-Age=0'))).toBe(true)
    expect(cookies.some((cookie) => cookie.startsWith(`${REFRESH_TOKEN_COOKIE_HOST}=`) && cookie.includes('Secure'))).toBe(true)
  })
})