import assert from "node:assert/strict";
import test from "node:test";
import { forwardMarketBatch, rejectNonLocalRequest } from "../vite.config.js";

test("keeps the import token in the local server-side forwarder", async () => {
  let forwarded;
  const response = await forwardMarketBatch('{"batchId":"one"}', {
    url: "https://l2.example/api/l2/market/import",
    token: "secret",
    fetchImpl: async (url, init) => {
      forwarded = { url, init };
      return Response.json({ imported: true });
    },
  });

  assert.equal(response.status, 200);
  assert.equal(forwarded.url, "https://l2.example/api/l2/market/import");
  assert.equal(forwarded.init.headers.Authorization, "Bearer secret");
  assert.equal(forwarded.init.body, '{"batchId":"one"}');
  assert.equal((await forwardMarketBatch("{}", {})).status, 503);
});

test("rejects cross-site and non-JSON calls before using the import token", () => {
  assert.equal(
    rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "http://127.0.0.1:5173", "content-type": "application/json" } }),
    null,
  );
  assert.equal(rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "https://evil.example", "content-type": "application/json" } }), 403);
  assert.equal(rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "http://127.0.0.1:5173", "content-type": "text/plain" } }), 415);
});