// Tests for the pre-join sign-in return helpers (joinreturn.js) — the guard
// that decides where a signed-in person may be redirected back to.
import test from "node:test";
import assert from "node:assert/strict";
import {
  parseJoinReturn, validJoinReturn, stashJoinReturn, readJoinReturnStash,
} from "../web/static/joinreturn.js";

const OK = "https://chat.example.com/join/abc?su=n1";

test("parseJoinReturn: the #joinret= fragment, decoded", () => {
  assert.equal(parseJoinReturn("#joinret=" + encodeURIComponent(OK)), OK);
  assert.equal(parseJoinReturn(""), "");
  assert.equal(parseJoinReturn("#claim=host"), "");
  assert.equal(parseJoinReturn("#joinret=%"), ""); // malformed encoding
});

test("validJoinReturn: https /join/ URLs only (http for localhost dev)", () => {
  assert.equal(validJoinReturn(OK), true);
  assert.equal(validJoinReturn("http://localhost:8080/join/abc?su=n"), true);
  assert.equal(validJoinReturn("http://127.0.0.1:8080/join/abc"), true);
  assert.equal(validJoinReturn("http://chat.example.com/join/abc"), false);
  assert.equal(validJoinReturn("https://chat.example.com/other"), false);
  assert.equal(validJoinReturn("https://u:p@chat.example.com/join/abc"), false);
  assert.equal(validJoinReturn("javascript:alert(1)"), false);
  assert.equal(validJoinReturn("not a url"), false);
});

test("stash round trip, expiry, tamper", () => {
  const now = 5_000_000;
  const s = stashJoinReturn(OK, now);
  assert.equal(readJoinReturnStash(s, now + 1000), OK);
  assert.equal(readJoinReturnStash(s, now + 61 * 60 * 1000), "");
  assert.equal(readJoinReturnStash(s, now - 1000), "");
  assert.equal(readJoinReturnStash("junk", now), "");
  assert.equal(readJoinReturnStash("", now), "");
  // A stash whose URL fails the guard reads as absent — validated on BOTH ends.
  assert.equal(readJoinReturnStash(stashJoinReturn("https://evil.example.com/x", now), now), "");
});