import { describe, expect, it } from "vitest";
import { COOKIE_NAME, newSessionId, parseSessionId, SESSION_ID_RE, sessionCookieHeader } from "./cookie";

describe("session cookie", () => {
  it("mints a 32-char hex id", () => {
    const id = newSessionId();
    expect(id).toMatch(SESSION_ID_RE);
    expect(id).toHaveLength(32);
  });

  it("parses our cookie out of a header", () => {
    const id = "ab".repeat(16);
    expect(parseSessionId(`${COOKIE_NAME}=${id}; other=1`)).toBe(id);
    expect(parseSessionId("other=1")).toBeNull();
    expect(parseSessionId(`${COOKIE_NAME}=not-hex`)).toBeNull();
  });

  it("uses SameSite=None only on HTTPS", () => {
    const id = "ab".repeat(16);
    expect(sessionCookieHeader(id, true)).toContain("SameSite=None");
    expect(sessionCookieHeader(id, true)).toContain("Secure");
    expect(sessionCookieHeader(id, false)).toContain("SameSite=Lax");
    expect(sessionCookieHeader(id, false)).not.toContain("Secure");
  });
});