<?php

declare(strict_types=1);

namespace Plugin\AzuraCastOnDemandHls\Tests\Cors;

use PHPUnit\Framework\Attributes\CoversClass;
use PHPUnit\Framework\TestCase;
use Plugin\AzuraCastOnDemandHls\Cors\CorsPolicy;

#[CoversClass(CorsPolicy::class)]
final class CorsPolicyTest extends TestCase
{
    private CorsPolicy $policy;

    protected function setUp(): void
    {
        $this->policy = new CorsPolicy(['https://aifrequency.org', 'https://www.aifrequency.org']);
    }

    public function testItAllowsTheFirstExplicitOrigin(): void
    {
        self::assertSame([
            'Access-Control-Allow-Origin' => 'https://aifrequency.org',
            'Vary' => 'Origin',
        ], $this->policy->headersFor('https://aifrequency.org'));
    }

    public function testItAllowsTheSecondExplicitOrigin(): void
    {
        self::assertSame('https://www.aifrequency.org', $this->policy->headersFor('https://www.aifrequency.org')['Access-Control-Allow-Origin']);
    }

    public function testItDoesNotAllowAnUnapprovedOrigin(): void
    {
        self::assertSame(['Vary' => 'Origin'], $this->policy->headersFor('https://evil.example'));
    }

    public function testItDoesNotAddCorsHeadersWithoutAnOrigin(): void
    {
        self::assertSame([], $this->policy->headersFor(null));
    }

    public function testItBuildsAConstrainedHlsPreflightResponse(): void
    {
        self::assertSame([
            'Access-Control-Allow-Origin' => 'https://aifrequency.org',
            'Vary' => 'Origin',
            'Access-Control-Allow-Methods' => 'GET, HEAD, OPTIONS',
            'Access-Control-Allow-Headers' => 'Range',
            'Access-Control-Max-Age' => '600',
        ], $this->policy->headersFor('https://aifrequency.org', true));
    }
}