using System.Linq;
using Paca.Browser.Extensions;
using Xunit;

namespace Paca.Tests.Browser;

public class ChromeExtensionCspValidatorTests
{
    [Fact]
    public void ValidateManifestCsp_Allows_Safe_Self_Policy()
    {
        var safeCsp = "script-src 'self'; object-src 'self';";
        var result = ExtensionCspValidator.Validate(safeCsp, manifestVersion: 3);

        Assert.True(result.IsValid);
        Assert.Empty(result.Violations);
        Assert.Equal("script-src 'self'; object-src 'self';", result.NormalizedCsp);
    }

    [Fact]
    public void ValidateManifestCsp_Rejects_UnsafeEval_In_ManifestV3()
    {
        var evalCsp = "script-src 'self' 'unsafe-eval'; object-src 'self';";
        var result = ExtensionCspValidator.Validate(evalCsp, manifestVersion: 3);

        Assert.False(result.IsValid);
        Assert.Contains(result.Violations, v => v.Contains("'unsafe-eval'"));
    }

    [Fact]
    public void ValidateManifestCsp_Rejects_Remote_Script_Sources_In_ManifestV3()
    {
        var remoteCsp = "script-src 'self' https://cdn.jsdelivr.net; object-src 'none';";
        var result = ExtensionCspValidator.Validate(remoteCsp, manifestVersion: 3);

        Assert.False(result.IsValid);
        Assert.Contains(result.Violations, v => v.Contains("remote script"));
    }

    [Fact]
    public void ValidateManifestCsp_Provides_Default_When_Null_Or_Empty()
    {
        var result = ExtensionCspValidator.Validate(null, manifestVersion: 3);

        Assert.True(result.IsValid);
        Assert.Equal(ExtensionCspValidator.DefaultManifestV3Csp, result.NormalizedCsp);
    }
}