import { readOAuthState, safeNext, signOAuthState } from './oauth-state';

describe('oauth state', () => {
  const secret = 'test-secret';

  it('round-trips a signed tenant state', () => {
    const token = signOAuthState({ kind: 'tenant', slug: 'demo', next: '/demo' }, secret);
    expect(readOAuthState(token, secret)).toEqual({ kind: 'tenant', slug: 'demo', next: '/demo' });
  });

  it('rejects a tampered state', () => {
    const token = signOAuthState({ kind: 'platform' }, secret);
    expect(() => readOAuthState(`${token}x`, secret)).toThrow();
  });

  it('blocks open redirects', () => {
    expect(safeNext('https://evil.test', '/admin')).toBe('/admin');
    expect(safeNext('//evil.test', '/admin')).toBe('/admin');
    expect(safeNext('/admin/clientes', '/admin')).toBe('/admin/clientes');
  });
});