// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
// SPDX-FileCopyrightText: 2025-2026 Christian Galo

package auth

import (
	"testing"

	"github.com/alexedwards/scs/v2"
	"github.com/spf13/viper"
)

// Finding 5 of the 2026-09 security audit: the session cookie was Secure only
// when env was exactly "production", so a TLS deployment under any other label
// shipped the cookie without it. It now follows base-url's scheme, the one
// declaration of the transport the browser sees.
func TestSessionCookieSecureFollowsTheBaseURLScheme(t *testing.T) {
	t.Cleanup(viper.Reset)
	for _, tc := range []struct {
		name    string
		baseURL string
		env     string
		want    bool
	}{
		{"https, labelled production", "https://console.example.coop", "production", true},
		{"https, labelled staging", "https://console.example.coop", "staging", true},
		{"https, labelled development", "https://console.example.coop", "development", true},
		{"plain http for local work", "http://member-console.localhost:9431", "development", false},
		{"plain http mislabelled production", "http://localhost:8081", "production", false},
	} {
		t.Run(tc.name, func(t *testing.T) {
			viper.Set("base-url", tc.baseURL)
			viper.Set("env", tc.env)
			sm := newSessionManager(scs.New().Store)
			if sm.Cookie.Secure != tc.want {
				t.Errorf("Cookie.Secure = %v, want %v", sm.Cookie.Secure, tc.want)
			}
			if !sm.Cookie.HttpOnly {
				t.Error("Cookie.HttpOnly must stay set")
			}
		})
	}
}