import { test } from 'node:test'
import assert from 'node:assert/strict'
import { readFile } from 'node:fs/promises'
import { JSDOM } from 'jsdom'

test('actual callback page forwards the original query/fragment URL through both channels', async () => {
  const html = await readFile(new URL('../../public/oauth-callback.html', import.meta.url), 'utf8')
  const callbackUrl = 'https://reams.test/oauth-callback.html?code=code&state=state&iss=https%3A%2F%2Fissuer.test#iss=https%3A%2F%2Fevil.test'
  const posted = []
  const dom = new JSDOM(html, { url: callbackUrl, runScripts: 'dangerously', beforeParse(window) {
    window.setTimeout = () => 0
    window.opener = { postMessage: (data, origin) => posted.push({ data, origin }) }
  } })
  try {
    const stored = JSON.parse(dom.window.localStorage.getItem('reams:oauth-callback'))
    assert.equal(stored.callback_url, callbackUrl)
    assert.equal(stored.code, 'code')
    assert.equal(stored.state, 'state')
    assert.equal(new URL(stored.callback_url).searchParams.get('iss'), 'https://issuer.test')
    assert.equal(new URLSearchParams(new URL(stored.callback_url).hash.slice(1)).get('iss'), 'https://evil.test')
    // A real postMessage structured-clones into the receiving realm.
    assert.deepEqual(JSON.parse(JSON.stringify(posted)), [{ data: stored, origin: 'https://reams.test' }])
  } finally { dom.window.close() }
})