import { afterEach, beforeEach, describe, expect, it } from "vitest";
import { secureCookies } from "./auth.js";

// The auth/CSRF cookies' Secure flag must be FAIL-SAFE: Secure by default, dropped only
// on a deliberate opt-out. The old behaviour (Secure iff NODE_ENV==="production") leaked
// cookies over plain HTTP on an appliance that forgot to set NODE_ENV — this pins the
// corrected matrix.

let savedCookieSecure: string | undefined;
let savedNodeEnv: string | undefined;

beforeEach(() => {
  savedCookieSecure = process.env.COOKIE_SECURE;
  savedNodeEnv = process.env.NODE_ENV;
  delete process.env.COOKIE_SECURE;
  delete process.env.NODE_ENV;
});
afterEach(() => {
  restore("COOKIE_SECURE", savedCookieSecure);
  restore("NODE_ENV", savedNodeEnv);
});
function restore(key: string, val: string | undefined) {
  if (val === undefined) delete process.env[key];
  else process.env[key] = val;
}

describe("secureCookies — fail-safe Secure flag", () => {
  it("defaults to Secure when nothing is set (the appliance-forgot-NODE_ENV case)", () => {
    expect(secureCookies()).toBe(true);
  });

  it("stays Secure in production", () => {
    process.env.NODE_ENV = "production";
    expect(secureCookies()).toBe(true);
  });

  it("drops Secure only for an explicit local-dev NODE_ENV", () => {
    process.env.NODE_ENV = "development";
    expect(secureCookies()).toBe(false);
  });

  it("COOKIE_SECURE override wins: falsey values opt OUT", () => {
    for (const v of ["0", "false", "no", "off", "FALSE", " Off "]) {
      process.env.COOKIE_SECURE = v;
      expect(secureCookies(), `COOKIE_SECURE=${JSON.stringify(v)}`).toBe(false);
    }
  });

  it("COOKIE_SECURE override wins: any other value opts IN (even in dev)", () => {
    process.env.NODE_ENV = "development";
    for (const v of ["1", "true", "yes", "on", ""]) {
      process.env.COOKIE_SECURE = v;
      expect(secureCookies(), `COOKIE_SECURE=${JSON.stringify(v)}`).toBe(true);
    }
  });
});