import { describe, expect, it } from "bun:test";

import { isTrustedInternalBridgeRequest } from "../../src/product/internal-bridge-auth.js";

const request = (headers: Record<string, string>) => ({
  header: (name: string) => headers[name.toLowerCase()],
});

describe("internal operational-task bridge authentication", () => {
  it("requires the server-only secret and rejects browser-originated requests", () => {
    expect(isTrustedInternalBridgeRequest(request({ "x-agent-internal-token": "secret" }), "secret")).toBe(true);
    expect(isTrustedInternalBridgeRequest(request({ "x-agent-internal-token": "known-session-id" }), "secret")).toBe(false);
    expect(isTrustedInternalBridgeRequest(request({
      "x-agent-internal-token": "secret",
      origin: "https://tjwater.example",
      "sec-fetch-site": "same-site",
    }), "secret")).toBe(false);
  });
});