import { describe, expect, it } from "vitest";
import { signableTarget } from "#lib/server/camotarget.ts";

const target = (url: string) => signableTarget(new URL(url));

describe("signableTarget", () => {
	it("allows public named http(s) hosts", () => {
		expect(target("https://example.com/a.png")).toBe(true);
		expect(target("http://i.imgcdn.test/a/b.png")).toBe(true);
		expect(target("https://mirror.example.co.uk:8443/x.png")).toBe(true);
	});

	it("blocks ip literals", () => {
		expect(target("http://127.0.0.1:8090/x.png")).toBe(false);
		expect(target("http://10.0.0.9/x.png")).toBe(false);
		expect(target("http://[::1]/x.png")).toBe(false);
		expect(target("http://[fd00::1]/x.png")).toBe(false);
	});

	it("blocks single-label service names", () => {
		expect(target("http://bobbin:8090/x.png")).toBe(false);
		expect(target("http://knot/x.png")).toBe(false);
	});

	it("blocks internal-use suffixes", () => {
		expect(target("http://bobbin.internal/x.png")).toBe(false);
		expect(target("http://app.localhost/x.png")).toBe(false);
		expect(target("http://nas.local/x.png")).toBe(false);
		expect(target("http://vm.home.arpa/x.png")).toBe(false);
	});

	it("rejects non-http(s) schemes upstream of the host check", () => {
		expect(target("file:///etc/passwd")).toBe(false);
		expect(target("javascript:alert(1)")).toBe(false);
	});
});