'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const {
  PREFIX,
  allowedRemoteRoute,
  rewritePayloadManagerHtml,
} = require('../../src/server/payload-manager-proxy');

test('Payload Manager proxy only admits the supported UI and API routes', () => {
  assert.equal(allowedRemoteRoute('/'), true);
  assert.equal(allowedRemoteRoute('/list_payloads'), true);
  assert.equal(allowedRemoteRoute('/manage:upload'), true);
  assert.equal(allowedRemoteRoute('/loadpayload:/data/payloads/etaHEN.bin'), false);
  assert.equal(allowedRemoteRoute('/processes_list'), true);
  assert.equal(allowedRemoteRoute('/process_kill'), false);
  assert.equal(allowedRemoteRoute('/process_kill?pid=42'), false);
  assert.equal(allowedRemoteRoute('/shutdown'), false);
  assert.equal(allowedRemoteRoute('/api/auth/status'), false);
  assert.equal(allowedRemoteRoute('/../secrets'), false);
  assert.equal(allowedRemoteRoute('//example.test'), false);
});

test('Payload Manager single-file UI is rewritten to its isolated token route', () => {
  const base = `${PREFIX}/t/${'a'.repeat(43)}`;
  const input = '<html manifest="/cache.appcache"><link href="/favicon.svg"><script>fetch(`/list_payloads`);new EventSource(\'/events\')</script></html>';
  const output = rewritePayloadManagerHtml(input, base);
  assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/cache\\.appcache`));
  assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/list_payloads`));
  assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/events`));
  assert.doesNotMatch(output, /fetch\(`\/list_payloads/);
});