import { describe, it, expect, vi, beforeAll } from "vitest";

vi.mock("astro:middleware", () => ({
  defineMiddleware: (fn: (ctx: unknown, next: () => Promise<Response>) => Promise<Response>) => fn,
}));

// Import après le mock
const { onRequest } = await import("./middleware.js");

const makeNext = (status = 200) => async () =>
  new Response("body", { status, headers: new Headers() });

async function invoke(status = 200): Promise<Response> {
  return (await onRequest({} as never, makeNext(status))) as Response;
}

describe("onRequest middleware (security headers)", () => {
  let res: Response;

  beforeAll(async () => {
    res = await invoke();
  });

  it.each([
    ["X-Content-Type-Options", "nosniff"],
    ["X-Frame-Options", "DENY"],
    ["X-XSS-Protection", "1; mode=block"],
    ["Referrer-Policy", "strict-origin-when-cross-origin"],
    ["X-Permitted-Cross-Domain-Policies", "none"],
  ])("header %s vaut %s", (header, value) => {
    expect(res.headers.get(header)).toBe(value);
  });

  it.each([
    ["Content-Security-Policy", "default-src 'self'"],
    ["Strict-Transport-Security", "max-age="],
    ["Permissions-Policy", "camera=()"],
  ])("header %s contient %s", (header, value) => {
    expect(res.headers.get(header)).toContain(value);
  });

  it("transmet le statut de la réponse d'origine", async () => {
    const r = await invoke(404);
    expect(r.status).toBe(404);
  });
});