import XCTest
@testable import RastrilloApple
final class OriginTests: XCTestCase {
  func testOriginRejectsCredentialAndCrossOriginShapes() throws {
    for value in ["http://example.com", "https://user:password@example.com", "https://example.com/path", "https://example.com?secret=1", "https://example.com#token", "file:///etc/passwd"] {
      XCTAssertThrowsError(try NativeHTTP.origin(value))
    }
    XCTAssertEqual(try NativeHTTP.origin(" https://example.com/ ").absoluteString, "https://example.com")
    XCTAssertEqual(try NativeHTTP.origin("http://127.0.0.1:8080").host, "127.0.0.1")
  }
  func testRequestCannotOverrideOrigin() async throws {
    let client = NativeHTTP(origin: try NativeHTTP.origin("https://example.com"))
    for path in ["//evil.test/x", "https://evil.test", "relative"] {
      do { _ = try await client.response(path); XCTFail("accepted unsafe path") }
      catch { XCTAssertEqual(error.localizedDescription, "Invalid server path.") }
    }
  }
}