import { describe, expect, it } from 'vitest';
import { resolveAuthCallbackURL } from './auth-redirect';

const CURRENT_ORIGIN = 'https://mosaic.example';

describe('resolveAuthCallbackURL', () => {
  it('preserves a canonical same-origin path with search and hash', () => {
    expect(resolveAuthCallbackURL('/projects?view=active#current', CURRENT_ORIGIN)).toBe(
      '/projects?view=active#current',
    );
  });

  it.each([
    null,
    'chat',
    '//evil.example',
    '/..//evil.com',
    '/..//evil.com/x',
    '/./..//evil.com',
    '/../..//evil.com',
    '/foo/..//evil.com',
    '/\\evil.example',
    '/\n//evil.example',
    '/\r//evil.example',
    '/\t//evil.example',
    'https://evil.example/phish',
  ])('falls back to chat for an unsafe callback target %#', (candidate) => {
    expect(resolveAuthCallbackURL(candidate, CURRENT_ORIGIN)).toBe('/chat');
  });
});
