import { describe, expect, it } from "vitest";

import {
  createRestProviderProfile,
  resolveRestSecurityProfiles,
  validateRestProfileBindings,
} from "../../src/contracts/rest-profiles.ts";
import { REFERENCE_FEATURE_CONTRACT } from "../../src/features/reference-feature/contracts/reference-feature-contract.ts";

describe("REST provider/auth/CSRF profiles", () => {
  it("preserves the provider prefix and rejects unsafe endpoint forms", () => {
    expect(
      createRestProviderProfile(
        "PRIMARY_API",
        "https://api.test/base/",
        ["omit"],
      ),
    ).toMatchObject({
      providerId: "PRIMARY_API",
      baseUrl: "https://api.test/base/",
      redirect: "error",
      referrerPolicy: "no-referrer",
    });
    expect(() =>
      createRestProviderProfile(
        "PRIMARY_API",
        "https://user:password@api.test/base/",
      ),
    ).toThrow("Invalid REST provider profile");
    expect(() =>
      createRestProviderProfile("PRIMARY_API", "http://api.test/base/"),
    ).toThrow("Invalid REST provider profile");
  });

  it("resolves bearer auth to omit credentials and no CSRF", () => {
    const operation =
      REFERENCE_FEATURE_CONTRACT.apiOperations.CREATE_REFERENCE_RESOURCE;
    const resolved = resolveRestSecurityProfiles(
      operation,
      createRestProviderProfile("PRIMARY_API", "https://api.test", ["omit"]),
    );
    expect(resolved).toMatchObject({
      auth: {
        transport: "BEARER_HEADER",
        credentials: "omit",
        allowedCredentialHeaders: ["authorization"],
      },
      csrf: { mode: "NONE" },
    });
  });

  it("validates every installed reference profile binding as a set", () => {
    expect(
      validateRestProfileBindings(
        REFERENCE_FEATURE_CONTRACT.apiOperations,
        { PRIMARY_API: ["omit"] },
      ),
    ).toBe(true);
    expect(() =>
      validateRestProfileBindings(
        REFERENCE_FEATURE_CONTRACT.apiOperations,
        {},
      ),
    ).toThrow("Unregistered REST provider binding");
  });
});