import Cookies from 'js-cookie';
import { clearBrowserSessionCookies, setAuthCredentials } from './api';

describe('browser auth storage', () => {
  it('never persists response auth headers in JavaScript-readable storage', () => {
    const cookie = vi.spyOn(Cookies, 'set');
    const storage = vi.spyOn(Storage.prototype, 'setItem');

    setAuthCredentials({
      data: { data: { id: 1 } },
      headers: { 'access-token': 'xss-readable-token', client: 'browser' },
    });

    expect(cookie).not.toHaveBeenCalled();
    expect(storage).not.toHaveBeenCalledWith(
      expect.any(String),
      expect.stringContaining('xss-readable-token')
    );
  });

  it('removes legacy auth storage during logout', () => {
    const removeCookie = vi.spyOn(Cookies, 'remove');
    const removeStorage = vi.spyOn(Storage.prototype, 'removeItem');

    clearBrowserSessionCookies();

    expect(removeCookie).toHaveBeenCalledWith('cw_d_session_info');
    expect(removeCookie).toHaveBeenCalledWith('cw_d_session_state');
    expect(removeStorage).toHaveBeenCalledWith('access-token');
    expect(removeStorage).toHaveBeenCalledWith('client');
  });
});