import { describe, expect, it } from "vitest"

import { secureJson, secureNoStoreHeaders } from "../secure-response"

describe("secureNoStoreHeaders (KAR-539)", () => {
  it("returns Cache-Control no-store and supporting headers", () => {
    const h = secureNoStoreHeaders()
    expect(h["Cache-Control"]).toContain("no-store")
    expect(h["Cache-Control"]).toContain("max-age=0")
    expect(h["Pragma"]).toBe("no-cache")
  })
})

describe("secureJson (KAR-539)", () => {
  it("wraps a JSON body with no-store headers and the given status", async () => {
    const response = secureJson({ ok: true }, { status: 201 })
    expect(response.status).toBe(201)
    expect(response.headers.get("Cache-Control")).toContain("no-store")
    expect(response.headers.get("Content-Type") ?? "").toContain("application/json")
    const body = await response.json()
    expect(body).toEqual({ ok: true })
  })

  it("defaults to 200 OK", () => {
    const response = secureJson({ ok: true })
    expect(response.status).toBe(200)
  })

  it("merges caller-provided headers without overriding no-store", () => {
    const response = secureJson({ ok: true }, { headers: { "X-Custom": "abc" } })
    expect(response.headers.get("X-Custom")).toBe("abc")
    expect(response.headers.get("Cache-Control")).toContain("no-store")
  })
})