package localaccess

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestNativeAndCursorOriginsAllowedUnrelatedPagesRejected(t *testing.T) {
	for _, origin := range []string{"", "vscode-file://vscode-app", "vscode-webview://fixture", "wails://wails", "http://127.0.0.1:9245", "https://api2.cursor.sh", "https://www.cursor.com"} {
		if !AllowedOrigin(origin) {
			t.Errorf("rejected %q", origin)
		}
	}
	for _, origin := range []string{"null", "https://evil.invalid", "https://api2.cursor.sh.evil.invalid", "https://api2.cursor.sh@evil.invalid", "file:///tmp/evil.html"} {
		called := false
		handler := Wrap(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { called = true }))
		r := httptest.NewRequest(http.MethodPost, "http://127.0.0.1/rpc", nil)
		r.Header.Set("Origin", origin)
		w := httptest.NewRecorder()
		handler.ServeHTTP(w, r)
		if w.Code != 403 || called {
			t.Errorf("origin %q reached backend", origin)
		}
	}
}