package httpapi

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestQAOrganizationSameOriginThroughReverseProxy(t *testing.T) {
	auth := newFakeAuthStore()
	auth.sessions["org-proxy-admin"] = "usr-boss"
	spy := &orgSpy{}
	handler, err := NewHandler(Config{Store: &fakeJobStore{}, QAOrg: spy, Auth: &AuthConfig{Store: auth}})
	if err != nil {
		t.Fatal(err)
	}
	for _, tc := range []struct {
		site   string
		status int
	}{{"same-origin", 200}, {"cross-site", 403}, {"same-site", 403}} {
		req := httptest.NewRequest("PUT", "http://internal-api:8080/api/v1/qa-ops/organization/regions", strings.NewReader(`{"directory_id":"d","base_revision":"","rules":[]}`))
		req.AddCookie(&http.Cookie{Name: sessionCookieName, Value: "org-proxy-admin"})
		req.Header.Set("X-Governance-Action", "qa-organization")
		req.Header.Set("Origin", "http://frontend:8088")
		req.Header.Set("Sec-Fetch-Site", tc.site)
		res := httptest.NewRecorder()
		handler.ServeHTTP(res, req)
		if res.Code != tc.status {
			t.Fatalf("proxy fetch site %s got %d want %d", tc.site, res.Code, tc.status)
		}
	}
}