import { describe, expect, it } from "vitest";
import { buildCallbackUrl, isRegisteredCallback, parseNativeStartQuery } from "./native";

function startUrl(params: Record<string, string>): URL {
  const url = new URL("https://loggedin.fyi/app/start");
  for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);
  return url;
}

describe("parseNativeStartQuery", () => {
  it("accepts a custom scheme callback for a valid origin", () => {
    const parsed = parseNativeStartQuery(
      startUrl({
        origin: "https://your-app.example",
        callback: "example.your-app://loggedin",
        state: "xyz",
      }),
    );
    expect(parsed).toEqual({
      ok: true,
      origin: "https://your-app.example",
      callback: "example.your-app://loggedin",
      state: "xyz",
    });
  });

  it("accepts an https universal link callback", () => {
    const parsed = parseNativeStartQuery(
      startUrl({
        origin: "https://your-app.example",
        callback: "https://your-app.example/native/loggedin",
      }),
    );
    expect(parsed.ok).toBe(true);
  });

  it("rejects script and data callbacks", () => {
    for (const callback of ["javascript:alert(1)", "data:text/html,<script>", "file:///etc/passwd"]) {
      const parsed = parseNativeStartQuery(
        startUrl({ origin: "https://your-app.example", callback }),
      );
      expect(parsed.ok).toBe(false);
    }
  });

  it("rejects a missing callback, a fragment, and an over-long one", () => {
    expect(parseNativeStartQuery(startUrl({ origin: "https://your-app.example" })).ok).toBe(false);
    expect(
      parseNativeStartQuery(
        startUrl({ origin: "https://your-app.example", callback: "app://cb#frag" }),
      ).ok,
    ).toBe(false);
    expect(
      parseNativeStartQuery(
        startUrl({ origin: "https://your-app.example", callback: `app://cb/${"x".repeat(600)}` }),
      ).ok,
    ).toBe(false);
  });

  it("rejects a non-origin or private-network origin", () => {
    expect(
      parseNativeStartQuery(startUrl({ origin: "https://a.example/path", callback: "app://cb" })).ok,
    ).toBe(false);
    expect(
      parseNativeStartQuery(startUrl({ origin: "http://192.168.1.5", callback: "app://cb" })).ok,
    ).toBe(false);
  });
});

describe("isRegisteredCallback", () => {
  it("requires an exact match against published redirect_uris", () => {
    const registered = ["example.your-app://loggedin", "https://your-app.example/oauth/callback"];
    expect(isRegisteredCallback("example.your-app://loggedin", registered)).toBe(true);
    expect(isRegisteredCallback("example.your-app://loggedin/evil", registered)).toBe(false);
    expect(isRegisteredCallback("example.evil://loggedin", registered)).toBe(false);
    expect(isRegisteredCallback("example.your-app://loggedin", [])).toBe(false);
    expect(isRegisteredCallback("example.your-app://loggedin", undefined)).toBe(false);
  });
});

describe("buildCallbackUrl", () => {
  it("appends parameters to a custom scheme", () => {
    const url = buildCallbackUrl("example.your-app://loggedin", {
      did: "did:plc:abc",
      token: "v1.a.b",
    });
    expect(url).toContain("did=did%3Aplc%3Aabc");
    expect(url).toContain("token=v1.a.b");
  });

  it("preserves an existing query on the registered callback", () => {
    const url = buildCallbackUrl("https://your-app.example/cb?keep=1", { denied: "1" });
    expect(url).toContain("keep=1");
    expect(url).toContain("denied=1");
  });
});