package main

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestSameOriginHost(t *testing.T) {
	cases := []struct {
		origin, host string
		want         bool
	}{
		{"https://panel.example.com", "panel.example.com", true},
		{"http://panel.example.com:8080", "panel.example.com:8080", true},
		{"https://PANEL.example.com", "panel.example.com", true},
		{"https://evil.com", "panel.example.com", false},
		{"https://panel.example.com.evil.com", "panel.example.com", false},
		{"null", "panel.example.com", false},
		{"", "panel.example.com", false},
	}
	for _, c := range cases {
		if got := sameOriginHost(c.origin, c.host); got != c.want {
			t.Errorf("sameOriginHost(%q, %q) = %v, want %v", c.origin, c.host, got, c.want)
		}
	}
}

func TestWithCORSReflection(t *testing.T) {
	h := withCORS(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))

	// Same-origin browser request: origin reflected.
	r := httptest.NewRequest("GET", "http://panel.local/api/agents", nil)
	r.Host = "panel.local"
	r.Header.Set("Origin", "https://panel.local")
	w := httptest.NewRecorder()
	h.ServeHTTP(w, r)
	if got := w.Header().Get("Access-Control-Allow-Origin"); got != "https://panel.local" {
		t.Errorf("same-origin ACAO = %q, want reflected origin", got)
	}

	// Cross-origin: no ACAO header at all.
	r = httptest.NewRequest("GET", "http://panel.local/api/agents", nil)
	r.Host = "panel.local"
	r.Header.Set("Origin", "https://evil.com")
	w = httptest.NewRecorder()
	h.ServeHTTP(w, r)
	if got := w.Header().Get("Access-Control-Allow-Origin"); got != "" {
		t.Errorf("cross-origin ACAO = %q, want empty", got)
	}

	// No Origin (curl/panelctl): no ACAO, request still passes through.
	r = httptest.NewRequest("OPTIONS", "http://panel.local/api/agents", nil)
	w = httptest.NewRecorder()
	h.ServeHTTP(w, r)
	if w.Code != http.StatusNoContent {
		t.Errorf("OPTIONS status = %d, want 204", w.Code)
	}
	if got := w.Header().Get("Cache-Control"); got == "" {
		t.Error("Cache-Control no-store stamp missing")
	}
}
