import { afterEach, describe, expect, it, vi } from "vitest";
import { publicHostname, securityReplySchema } from "@/lib/security-policy";
import { scanPublicSite, verifyDnsOwnership, readEdgeFor } from "@/lib/security.server";
afterEach(() => { vi.unstubAllGlobals(); vi.unstubAllEnvs(); });
describe("Aegis security boundaries", () => {
  it("supports external public websites without accepting internal addresses", () => {
    expect(publicHostname("https://www.wordpress.org/path")).toBe("www.wordpress.org");
    for (const url of ["http://127.0.0.1", "http://localhost", "https://site.internal", "https://user:pass@example.com", "http://example.com:8080", "file:///etc/passwd"]) expect(() => publicHostname(url)).toThrow();
  });
  it("requires a permission handoff flag in assistant replies", () => {
    expect(securityReplySchema.parse({ answer: "Would you like to open Echo?", handoff: true }).handoff).toBe(true);
    expect(securityReplySchema.safeParse({ answer: "Redirecting now" }).success).toBe(false);
  });
  it("uses only the fixed public scanning service and returns the actual A+ through F grade", async () => {
    const fetchMock = vi.fn().mockResolvedValueOnce(Response.json({ id: 1 })).mockResolvedValueOnce(Response.json({ scan: { grade: "F", score: 10, scanned_at: "2026-11-02T07:00:00Z", tests_passed: 7, tests_failed: 5 }, tests: { "x-content-type-options": { pass: false, result: "missing" } } }));
    vi.stubGlobal("fetch", fetchMock);
    const result = await scanPublicSite("example.com");
    expect(result.grade).toBe("F");
    expect(result.failed).toBe(5);
    expect(result.findings[0]?.pass).toBe(false);
    expect(fetchMock.mock.calls.map(c => c[0])).toEqual(["https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com", "https://observatory-api.mdn.mozilla.net/api/v2/analyze?host=example.com"]);
  });
  it("does not mark external ownership verified for a different TXT token", async () => {
    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(Response.json({ Answer: [{ type: 16, data: '"codesynux-verify=other"' }] })));
    expect(await verifyDnsOwnership("example.com", "expected")).toBe(false);
  });
  it("preserves the actual observation time when a slow scan uses a cached report", async () => {
    vi.stubGlobal("fetch", vi.fn().mockRejectedValueOnce(new DOMException("Timed out", "TimeoutError")).mockResolvedValueOnce(Response.json({ scan: { grade: "F", score: 10, scanned_at: "2026-11-02T07:00:00Z", tests_passed: 7, tests_failed: 5 }, tests: {} })));
    const report = await scanPublicSite("example.com");
    expect(report.scannedAt).toBe("2026-11-02T07:00:00Z");
  });
  it("never returns builder zone inventory for an unverified user domain", async () => {
    vi.stubEnv("LOVABLE_API_KEY", "test-only"); vi.stubEnv("CLOUDFLARE_API_KEY", "test-only");
    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(Response.json({ success: true, result: [{ id: "private", name: "private-owner.com", status: "active" }], result_info: { total_pages: 1 } })));
    const result = await readEdgeFor([]);
    expect(result.sites).toEqual([]); expect(result.events).toEqual([]);
  });
});