import { normalizeOidcForwardedProto } from './oidc-forwarded-proto';

describe('normalizeOidcForwardedProto', () => {
  it('corrects an OIDC request when the trusted public issuer uses HTTPS', () => {
    const request = {
      method: 'GET',
      originalUrl: '/oidc/auth?client_id=test',
      headers: { 'x-forwarded-proto': 'http' },
    };

    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);

    expect(result).toEqual({ corrected: true, path: '/oidc/auth', previousProto: 'http' });
    expect(request.headers['x-forwarded-proto']).toBe('https');
  });

  it('also corrects interaction routes used to finish login and consent', () => {
    const request = { originalUrl: '/interaction/uid/login', headers: {} as Record<string, string> };

    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);

    expect(result.corrected).toBe(true);
    expect(request.headers['x-forwarded-proto']).toBe('https');
  });

  it('does not alter unrelated API requests', () => {
    const request = { originalUrl: '/api/account', headers: { 'x-forwarded-proto': 'http' } };

    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);

    expect(result.corrected).toBe(false);
    expect(request.headers['x-forwarded-proto']).toBe('http');
  });

  it('does not override the protocol when proxy trust is disabled', () => {
    const request = { originalUrl: '/oidc/auth', headers: { 'x-forwarded-proto': 'http' } };

    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', false);

    expect(result.corrected).toBe(false);
    expect(request.headers['x-forwarded-proto']).toBe('http');
  });

  it('does not force HTTPS for a configured HTTP issuer', () => {
    const request = { originalUrl: '/oidc/auth', headers: { 'x-forwarded-proto': 'http' } };

    const result = normalizeOidcForwardedProto(request, 'http://localhost:8080', true);

    expect(result.corrected).toBe(false);
    expect(request.headers['x-forwarded-proto']).toBe('http');
  });
});