import assert from 'node:assert/strict';
import test from 'node:test';
import { createContext } from '../src/server/context';
import type { Data } from '../src/server/services/model';
import { loadSharedData } from '../src/server/services/shared';

const sharedFixture = (): Data => ({
 appConfig: { config: {} }, categoryList: [{ name: '首页', urlValue: '/', categoryType: 1 }],
 themeList: [], homeConfigData: [], searchTrends: [],
});
const context = (avatar: string, cookieAvatar = avatar) => {
 const ctx = createContext(new Request('http://site.test/profile/', {
  headers: { cookie: `token=guest-session; avatar=${encodeURIComponent(cookieAvatar)}` },
 }));
 ctx.user = { userId: 7, nickName: '游客', avatar, type: 0, token: 'guest-session' };
 return ctx;
};

test('shared avatars preserve API image keys and usable URLs, reject other relative paths, and never rewrite auth values', async () => {
 const relative = 'v3/image/guest/avatar.enc';
 for (const [avatar, cookieAvatar, expected] of [
  [relative, relative, relative],
  ['/v3/image/guest/avatar.enc', '/v3/image/guest/avatar.enc', '/v3/image/guest/avatar.enc'],
  ['ordinary-relative-avatar.png', 'ordinary-relative-avatar.png', ''],
  ['//cdn.test/avatar.png', '//cdn.test/avatar.png', ''],
  ['javascript:alert(1)', 'javascript:alert(1)', ''],
  ['https://', 'https://', ''],
  [' https://cdn.test/avatar.enc?key=abc ', relative, 'https://cdn.test/avatar.enc?key=abc'],
  ['http://cdn.test/avatar.png', relative, 'http://cdn.test/avatar.png'],
  ['/static/images/profile/avatar.png', relative, '/static/images/profile/avatar.png'],
  [relative, 'https://cdn.test/cookie-avatar.png', relative],
  ['ordinary-relative-avatar.png', 'https://cdn.test/cookie-avatar.png', 'https://cdn.test/cookie-avatar.png'],
 ] as const) {
  const ctx = context(avatar, cookieAvatar);
  const requestCookie = ctx.headers.get('cookie');
  const data = await loadSharedData(ctx, sharedFixture());
  assert.equal(data.avatar, expected, avatar);
  assert.equal(ctx.user?.avatar, avatar);
  assert.equal(ctx.user?.token, 'guest-session');
  assert.equal(ctx.token, 'guest-session');
  assert.equal(ctx.getCookie('avatar'), cookieAvatar);
  assert.equal(ctx.headers.get('cookie'), requestCookie);
  assert.deepEqual(ctx.responseHeaders.getSetCookie(), []);
 }
});