import { expect, test } from "bun:test";
import { sameOriginReport } from "./report-origin";

const url = "https://shop--alice.sites.example.net/__gitfor/report";
const post = (origin?: string) =>
  new Request(url, { method: "POST", headers: origin ? { origin } : {}, body: "phishing" });

test("only same-origin browser posts may report a site", () => {
  expect(sameOriginReport(post("https://shop--alice.sites.example.net"))).toBe(true);
  expect(sameOriginReport(post("https://evil.example.com"))).toBe(false);
  expect(sameOriginReport(post("null"))).toBe(false);
  expect(sameOriginReport(post())).toBe(false);
});