import { describe, it, expect } from 'vitest'
import { isSafeExternalUrl, isSafeInternalPath } from './url'

describe('open-redirect protection', () => {
  it('allows listed hosts over http(s)', () => {
    expect(isSafeExternalUrl('https://mock-bank.example/auth/x', ['mock-bank.example'])).toBe(true)
  })
  it('rejects other hosts and schemes', () => {
    expect(isSafeExternalUrl('https://evil.com/x', ['mock-bank.example'])).toBe(false)
    expect(isSafeExternalUrl('javascript:alert(1)', ['mock-bank.example'])).toBe(false)
    expect(isSafeExternalUrl('data:text/html,x', ['mock-bank.example'])).toBe(false)
  })
  it('internal paths reject protocol-relative', () => {
    expect(isSafeInternalPath('/pay')).toBe(true)
    expect(isSafeInternalPath('//evil.com')).toBe(false)
  })
})