import { describe, expect, it } from 'vitest'

import { isRequestHostAllowed } from '@/lib/security/requestHost'

describe('isRequestHostAllowed', () => {
  it.each(['backoffice.ghabilee.ir', 'backoffice.ghabilee.ir:443', 'BACKOFFICE.GHABILEE.IR'])(
    'allows a canonical production host: %s',
    (host) => {
      expect(isRequestHostAllowed(host, 'production')).toBe(true)
    }
  )

  it.each([
    null,
    '',
    'ghabilee.ir',
    'www.ghabilee.ir',
    'dev.ghabilee.ir',
    'arashmohammadi.com',
    'backoffice.ghabilee.ir.attacker.example',
    'backoffice.ghabilee.ir@attacker.example',
    'backoffice.ghabilee.ir/path',
    'backoffice.ghabilee.ir, attacker.example',
    'backoffice.ghabilee.ir:65536',
  ])('rejects an untrusted or malformed production host: %s', (host) => {
    expect(isRequestHostAllowed(host, 'production')).toBe(false)
  })

  it('does not block local development hosts', () => {
    expect(isRequestHostAllowed('127.0.0.1:3008', 'development')).toBe(true)
    expect(isRequestHostAllowed('localhost:3008', 'test')).toBe(true)
  })

  it('allows loopback hosts in production only when ALLOW_LOCAL_REQUEST_HOSTS is set', () => {
    const previous = process.env.ALLOW_LOCAL_REQUEST_HOSTS

    delete process.env.ALLOW_LOCAL_REQUEST_HOSTS
    expect(isRequestHostAllowed('127.0.0.1:3102', 'production')).toBe(false)

    process.env.ALLOW_LOCAL_REQUEST_HOSTS = '1'
    expect(isRequestHostAllowed('127.0.0.1:3102', 'production')).toBe(true)
    expect(isRequestHostAllowed('localhost:3102', 'production')).toBe(true)

    if (previous === undefined) delete process.env.ALLOW_LOCAL_REQUEST_HOSTS
    else process.env.ALLOW_LOCAL_REQUEST_HOSTS = previous
  })
})