package com.correx.core.toolintent

import com.correx.core.toolintent.rules.EgressAllowlist
import kotlin.test.Test
import kotlin.test.assertFalse
import kotlin.test.assertTrue

class EgressAllowlistTest {

    @Test
    fun `host in static set only is allowed`() {
        assertTrue(EgressAllowlist.isAllowed("good.com", setOf("good.com"), emptySet()))
    }

    @Test
    fun `host in session set only is allowed`() {
        assertTrue(EgressAllowlist.isAllowed("granted.com", emptySet(), setOf("granted.com")))
    }

    @Test
    fun `host in neither set is denied when an allow-list exists`() {
        assertFalse(EgressAllowlist.isAllowed("other.com", setOf("good.com"), setOf("granted.com")))
    }

    @Test
    fun `empty union allows any host`() {
        assertTrue(EgressAllowlist.isAllowed("anywhere.example.com", emptySet(), emptySet()))
    }

    @Test
    fun `suffix match is honoured for static hosts`() {
        assertTrue(EgressAllowlist.isAllowed("api.good.com", setOf("good.com"), emptySet()))
    }

    @Test
    fun `suffix match is honoured for session hosts`() {
        assertTrue(EgressAllowlist.isAllowed("docs.granted.com", emptySet(), setOf("granted.com")))
    }

    @Test
    fun `suffix match does not leak across unrelated domains`() {
        // "evilgood.com" must NOT match a configured "good.com" — only true subdomains.
        assertFalse(EgressAllowlist.isAllowed("evilgood.com", setOf("good.com"), emptySet()))
    }

    @Test
    fun `matching is case-insensitive`() {
        assertTrue(EgressAllowlist.isAllowed("API.Good.COM", setOf("good.com"), emptySet()))
        assertTrue(EgressAllowlist.isAllowed("api.good.com", setOf("GOOD.COM"), emptySet()))
        assertTrue(EgressAllowlist.isAllowed("api.granted.com", emptySet(), setOf("Granted.Com")))
    }
}
