package onboarding

import (
	"net/http/httptest"
	"testing"
)

func TestBrowserTransportThroughConfiguredLocalProxy(t *testing.T) {
	for _, tc := range []struct {
		name, remote, proto string
		local, want         bool
	}{
		{"local trusted HTTP", "172.18.0.4:4000", "http", true, true},
		{"production rejects HTTP", "172.18.0.4:4000", "http", false, false},
		{"trusted HTTPS", "172.18.0.4:4000", "https", false, true},
		{"untrusted HTTP", "172.19.0.4:4000", "http", true, false},
		{"untrusted HTTPS header", "172.19.0.4:4000", "https", true, false},
		{"missing proxy header", "172.18.0.4:4000", "", true, false},
		{"local loopback", "127.0.0.1:4000", "", true, true},
	} {
		t.Run(tc.name, func(t *testing.T) {
			s := &Service{options: Options{AllowLocalHTTP: tc.local, TrustedProxyCIDRs: []string{"172.18.0.0/16"}}}
			r := httptest.NewRequest("GET", "http://localhost:3100/api/v1/web/login/session", nil)
			r.RemoteAddr = tc.remote
			r.Header.Set("X-Forwarded-Proto", tc.proto)
			if got := s.secure(r); got != tc.want {
				t.Fatalf("secure=%v, want %v", got, tc.want)
			}
		})
	}
}