import { describe, expect, it } from "vitest";

import { isValidRpId } from "./passkey-utils";

describe("isValidRpId (Firefox passkey rpId↔origin validation, SEV-1-A)", () => {
  it("accepts rpId equal to the caller hostname", () => {
    expect(isValidRpId("google.com", "https://google.com")).toBe(true);
  });

  it("accepts rpId as a registrable suffix of the caller", () => {
    expect(isValidRpId("google.com", "https://accounts.google.com")).toBe(true);
  });

  it("rejects rpId from an unrelated domain", () => {
    expect(isValidRpId("google.com", "https://evil.com")).toBe(false);
  });

  it("rejects rpId spoofing via suffix confusion", () => {
    expect(isValidRpId("google.com", "https://evil.google.com.attacker.com")).toBe(false);
  });

  it("rejects a bare-eTLD rpId", () => {
    expect(isValidRpId("com", "https://google.com")).toBe(false);
  });

  it("rejects a dotless rpId such as localhost", () => {
    expect(isValidRpId("localhost", "https://localhost")).toBe(false);
  });

  it("rejects an unparseable caller origin", () => {
    expect(isValidRpId("google.com", "not a url")).toBe(false);
  });

  it("is case-insensitive on host and rpId", () => {
    expect(isValidRpId("Google.com", "https://ACCOUNTS.google.COM")).toBe(true);
  });
});