import { expect, test } from "../fixtures";

test("owner can open the app but missing or foreign identity is forbidden", async ({ request }) => {
  expect((await request.get("/")).status()).toBe(200);
  expect((await request.get("/", { headers: { "Tailscale-User-Login": "" } })).status()).toBe(403);
  expect(
    (
      await request.get("/", {
        headers: { "Tailscale-User-Login": "other@twitter-lite.invalid" },
      })
    ).status(),
  ).toBe(403);
});

test("mutations require exact Origin even with same-origin Fetch Metadata", async ({ request }) => {
  expect((await request.post("/")).status()).toBe(403);
  expect(
    (
      await request.post("/", {
        headers: {
          Origin: "https://other.invalid",
          "Sec-Fetch-Site": "same-origin",
        },
      })
    ).status(),
  ).toBe(403);
});

test("server functions also reject foreign identity and cross-site calls", async ({
  page,
  request,
}) => {
  const serverRequest = page.waitForRequest((request) => request.url().includes("/_serverFn/"));
  await page.goto("/deck");
  const url = (await serverRequest).url();
  expect(
    (
      await request.get(url, {
        headers: {
          "Tailscale-User-Login": "other@twitter-lite.invalid",
          "Sec-Fetch-Site": "same-origin",
        },
      })
    ).status(),
  ).toBe(403);
  expect(
    (
      await request.get(url, {
        headers: { "Sec-Fetch-Site": "cross-site" },
      })
    ).status(),
  ).toBe(403);
});