import assert from "node:assert/strict";
import test from "node:test";
import { buildAuthPath, getSafeAuthReturnTo } from "../src/lib/auth-return.ts";

test("keeps an internal route with its query and fragment", () => {
  assert.equal(
    getSafeAuthReturnTo("/events/summer-workshop?source=home#register"),
    "/events/summer-workshop?source=home#register",
  );
});

test("falls back for external and malformed return paths", () => {
  for (const value of [
    "https://attacker.example/",
    "//attacker.example/",
    "/\\attacker.example/",
    `/${String.fromCharCode(0)}forbidden`,
    "javascript:alert(1)",
  ]) {
    assert.equal(getSafeAuthReturnTo(value), "/profile");
  }
});

test("does not return to authentication or logout routes", () => {
  for (const value of ["/auth", "/auth/google/callback", "/logout", "/reset-password"]) {
    assert.equal(getSafeAuthReturnTo(value), "/profile");
  }
});

test("builds a login link that safely encodes the requested route", () => {
  assert.equal(
    buildAuthPath("/events/summer-workshop?source=home"),
    "/auth?next=%2Fevents%2Fsummer-workshop%3Fsource%3Dhome",
  );
  assert.equal(buildAuthPath("//attacker.example/"), "/auth?next=%2Fprofile");
});