import { describe, expect, mock, test } from "bun:test";

mock.module("cloudflare:workers", () => ({ env: { FORGE_NAME: "gitfor" }, waitUntil: () => undefined }));
const { claimPage } = await import("./claim-page");

describe("claim page", () => {
  test("defaults the repository to private and reads the token from the fragment under a nonce", async () => {
    const response = claimPage("alice", "", "abc123");
    const body = await response.text();
    expect(body).toMatch(/<input type="checkbox" name="public">/);
    expect(body).not.toContain("checked");
    expect(body).toContain('<script nonce="abc123">');
    expect(body).toContain("location.hash");
    const csp = response.headers.get("content-security-policy") ?? "";
    expect(csp).toContain("script-src 'nonce-abc123'");
    expect(csp).toContain("form-action 'self'");
    expect(response.headers.get("referrer-policy")).toBe("no-referrer");
  });

  test("escapes a legacy query-string token", async () => {
    const body = await claimPage("alice", '"><script>', "n").text();
    expect(body).not.toContain('"><script>');
  });
});