import test from 'node:test';
import assert from 'node:assert/strict';
import {
  loadWechatOAuthConfig,
  sanitizeWechatReturnTo,
} from './wechat-oauth.mjs';

test('loadWechatOAuthConfig requires app secret and callback url', () => {
  const config = loadWechatOAuthConfig({
    H5_WECHAT_OAUTH_ENABLED: '1',
    H5_WECHAT_APP_ID: 'wxtest',
    H5_WECHAT_APP_SECRET: 'secret',
    H5_PUBLIC_BASE_URL: 'https://example.com',
  });
  assert.equal(config.enabled, true);
  assert.equal(config.callbackUrl, 'https://example.com/auth/wechat/callback');
});

test('sanitizeWechatReturnTo rejects external urls', () => {
  const req = { get: (name) => (name === 'host' ? 'example.com' : null) };
  assert.equal(sanitizeWechatReturnTo('https://evil.com/phish', req), '/');
  assert.equal(sanitizeWechatReturnTo('/space?page=1', req), '/space?page=1');
});