import { afterEach, describe, expect, it, vi } from "vitest";
import { liveLabAvailability } from "../../src/webauthn/live";

describe("live WebAuthn origin isolation", () => {
  afterEach(() => vi.unstubAllGlobals());

  it("rejects the shared Portal origin", () => {
    vi.stubGlobal("isSecureContext", true);
    expect(
      liveLabAvailability({
        hostname: "toolbox.add-ideas.de",
        origin: "https://toolbox.add-ideas.de",
      }),
    ).toMatchObject({ available: false, rpId: "toolbox.add-ideas.de" });
  });

  it("accepts only the dedicated production host and local development", () => {
    vi.stubGlobal("isSecureContext", true);
    expect(
      liveLabAvailability({
        hostname: "auth.toolbox.add-ideas.de",
        origin: "https://auth.toolbox.add-ideas.de",
      }).available,
    ).toBe(true);
    expect(
      liveLabAvailability({
        hostname: "127.0.0.1",
        origin: "http://127.0.0.1:4173",
      }).available,
    ).toBe(true);
  });

  it("requires a secure context on every host", () => {
    vi.stubGlobal("isSecureContext", false);
    expect(
      liveLabAvailability({
        hostname: "auth.toolbox.add-ideas.de",
        origin: "http://auth.toolbox.add-ideas.de",
      }),
    ).toMatchObject({
      available: false,
      reason: "WebAuthn requires a secure context.",
    });
  });
});