import type { ServerResponse } from 'node:http';
import { describe, expect, it, vi } from 'vitest';
import { setCorsHeaders } from '@electron/api/route-utils';

describe('Host API CORS', () => {
  it.each([
    'http://127.0.0.1:5173',
    'http://localhost:5173',
  ])('allows the configured Renderer development origin %s', (origin) => {
    const setHeader = vi.fn();
    setCorsHeaders({ setHeader } as unknown as ServerResponse, origin);
    expect(setHeader).toHaveBeenCalledWith('Access-Control-Allow-Origin', origin);
  });

  it('does not allow an arbitrary loopback origin', () => {
    const setHeader = vi.fn();
    setCorsHeaders(
      { setHeader } as unknown as ServerResponse,
      'http://127.0.0.1:54722',
    );
    expect(setHeader).not.toHaveBeenCalledWith('Access-Control-Allow-Origin', expect.anything());
  });
});