import type { ServerResponse } from 'node:http';
import { describe, expect, it, vi } from 'vitest';
import { setCorsHeaders } from '@electron/api/route-utils';

describe('Host API CORS', () => {
  it('allows only the current dynamic OpenCode runtime origin', () => {
    const setHeader = vi.fn();
    const response = { setHeader } as unknown as ServerResponse;

    setCorsHeaders(
      response,
      'http://127.0.0.1:54721',
      'http://127.0.0.1:54721',
    );

    expect(setHeader).toHaveBeenCalledWith(
      'Access-Control-Allow-Origin',
      'http://127.0.0.1:54721',
    );
  });

  it('does not allow another loopback port when the runtime uses a dynamic port', () => {
    const setHeader = vi.fn();
    const response = { setHeader } as unknown as ServerResponse;

    setCorsHeaders(
      response,
      'http://127.0.0.1:54722',
      'http://127.0.0.1:54721',
    );

    expect(setHeader).not.toHaveBeenCalledWith(
      'Access-Control-Allow-Origin',
      expect.anything(),
    );
  });

  it('does not retain the preferred runtime port after falling back dynamically', () => {
    const setHeader = vi.fn();
    const response = { setHeader } as unknown as ServerResponse;

    setCorsHeaders(
      response,
      'http://127.0.0.1:4096',
      'http://127.0.0.1:54721',
    );

    expect(setHeader).not.toHaveBeenCalledWith(
      'Access-Control-Allow-Origin',
      expect.anything(),
    );
  });
});