/**
 * Tests for createWildcardCorsOptions utility
 * Critical for CORS security and functionality
 */

import { createWildcardCorsOptions } from '../createWildcardCorsOptions';

describe('createWildcardCorsOptions', () => {
  it('should create CORS options with exact origin matching', () => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: false
    });

    expect(corsOptions).toHaveProperty('origin');
    expect(typeof corsOptions.origin).toBe('function');
  });

  it('should allow null origins when allowNullOrigin is true', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: true
    });

    const originCallback = corsOptions.origin as Function;
    originCallback(null, (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(true);
      done();
    });
  });

  it('should allow literal "null" string origins when allowNullOrigin is true', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: true
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('null', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(true);
      done();
    });
  });

  it('should reject null origins when allowNullOrigin is false', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback(null, (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(false);
      done();
    });
  });

  it('should reject literal "null" string origins when allowNullOrigin is false', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('null', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(false);
      done();
    });
  });

  it('should match exact origins', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('https://example.com', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(true);
      done();
    });
  });

  it('should match wildcard patterns', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://*.example.com'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('https://api.example.com', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(true);
      done();
    });
  });

  it('should treat wildcard as a localhost port placeholder', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['http://localhost:*'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;

    originCallback('http://localhost:5173', (viteError: any, viteAllowed: boolean) => {
      expect(viteError).toBeNull();
      expect(viteAllowed).toBe(true);

      originCallback('http://localhost:8080', (nodeError: any, nodeAllowed: boolean) => {
        expect(nodeError).toBeNull();
        expect(nodeAllowed).toBe(true);

        originCallback('http://localhost.evil:8080', (evilError: any, evilAllowed: boolean) => {
          expect(evilError).toBeNull();
          expect(evilAllowed).toBe(false);
          done();
        });
      });
    });
  });

  it('should match wildcard suffix patterns for ai-universe frontends', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://ai-universe-frontend*.run.app'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback(
      'https://ai-universe-frontend-dev-elhm2qjlta-uc.a.run.app',
      (error: any, allowed: boolean) => {
        expect(error).toBeNull();
        expect(allowed).toBe(true);
        done();
      }
    );
  });

  it('should reject ai-universe lookalike domains outside Cloud Run', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://ai-universe-frontend*.run.app'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('https://ai-universe-frontend.evil.com', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(false);
      done();
    });
  });

  it('should allow Cloud Run PR preview frontends', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://ai-universe-frontend-s*-*-*.a.run.app'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback(
      'https://ai-universe-frontend-s1-elhm2qjlta-uc.a.run.app',
      (error: any, allowed: boolean) => {
        expect(error).toBeNull();
        expect(allowed).toBe(true);

        originCallback(
          'https://ai-universe-frontend-s2-elhm2qjlta-uc.a.run.app',
          (innerError: any, innerAllowed: boolean) => {
            expect(innerError).toBeNull();
            expect(innerAllowed).toBe(true);
            done();
          }
        );
      }
    );
  });

  it('should allow agent-universe apex domain and subdomains while rejecting lookalikes', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://agent-universe.ai', 'https://*.agent-universe.ai'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;

    originCallback('https://agent-universe.ai', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(true);

      originCallback('https://beta.agent-universe.ai', (subdomainError: any, subdomainAllowed: boolean) => {
        expect(subdomainError).toBeNull();
        expect(subdomainAllowed).toBe(true);

        originCallback(
          'https://agent-universe.ai.attacker.com',
          (lookalikeError: any, lookalikeAllowed: boolean) => {
            expect(lookalikeError).toBeNull();
            expect(lookalikeAllowed).toBe(false);
            done();
          }
        );
      });
    });
  });

  it('should reject non-matching origins', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('https://evil.com', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(false);
      done();
    });
  });

  it('should normalize origins by removing trailing slash', (done) => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: false
    });

    const originCallback = corsOptions.origin as Function;
    originCallback('https://example.com/', (error: any, allowed: boolean) => {
      expect(error).toBeNull();
      expect(allowed).toBe(true);
      done();
    });
  });

  it('should have proper CORS configuration', () => {
    const corsOptions = createWildcardCorsOptions({
      allowedOrigins: ['https://example.com'],
      allowNullOrigin: true
    });

    expect(corsOptions).toMatchObject({
      methods: ['GET', 'HEAD', 'POST', 'OPTIONS'],
      allowedHeaders: ['Content-Type', 'Accept', 'Authorization'],
      credentials: true,
      maxAge: 86400,
      optionsSuccessStatus: 200
    });
  });
});