// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
// A deployment the contract refuses says why: `/api/ready` names what to set, every other route is a 503 and no route
// a 500, and a message that quotes a value stays in the log. And signing out can reach the identity provider.

import { describe, expect, it } from "vitest"
import { issuerOrigins, refusalOf, refusalResponse } from "../apps/web/src/server/contract"

const refusal = refusalOf(new Error("OIDC_ISSUER is required in production"))
const request = (path: string): Request => new Request(`https://app.example.test${path}`)

describe("a process the deployment contract refused", () => {
  it("names what to set on /api/ready", async () => {
    const response = refusalResponse(request("/api/ready"), refusal)
    expect(response.status).toBe(503)
    expect(await response.json()).toEqual({
      ready: false,
      checks: { contract: false },
      reason: "OIDC_ISSUER is required in production",
    })
  })

  it("answers every other route 503, and says nothing more there", async () => {
    const response = refusalResponse(request("/acme"), refusal)
    expect(response.status).toBe(503)
    expect(response.headers.get("retry-after")).toBe("30")
    expect(await response.json()).toEqual({ status: 503, code: "not_configured" })
  })

  it("keeps a value out of what the public can read", async () => {
    const quoted = refusalOf(new Error('CONUSAI_API_URL is "https://secret.example.test"'))
    expect(quoted.message).toContain("secret.example.test")
    expect(JSON.stringify(await refusalResponse(request("/api/ready"), quoted).json())).not.toContain("secret")
  })
})

describe("the form-action of the content security policy", () => {
  it("adds the issuer's origin, without its path", () => {
    expect(issuerOrigins("https://id.example.test/oauth/v2")).toEqual(["https://id.example.test"])
  })

  it("adds nothing with no issuer", () => {
    expect(issuerOrigins(undefined)).toEqual([])
    expect(issuerOrigins(" ")).toEqual([])
  })
})