/** @jest-environment node */

import { NextRequest } from 'next/server'
import { GET, POST } from './route'

describe('/api/network-status', () => {
  test('GET 只返回前端需要的网络状态，不再暴露客户端诊断信息', async () => {
    const response = await GET(new NextRequest('https://sc.jiansun.vip/api/network-status', {
      headers: {
        origin: 'https://attacker.example',
        'x-forwarded-for': '203.0.113.10, 192.168.58.20',
      },
    }))
    const body = await response.json()

    expect(response.status).toBe(200)
    expect(Object.keys(body).sort()).toEqual(['isIntranet', 'success', 'timestamp'])
    expect(response.headers.get('access-control-allow-origin')).toBeNull()
    expect(response.headers.get('cache-control')).toBe('no-store')
  })

  test('POST 直接返回 405，且不读取请求正文', async () => {
    const arrayBuffer = jest.fn(() => {
      throw new Error('不应读取正文')
    })

    const response = await (POST as any)({ arrayBuffer })
    const body = await response.json()

    expect(response.status).toBe(405)
    expect(response.headers.get('allow')).toBe('GET')
    expect(arrayBuffer).not.toHaveBeenCalled()
    expect(body.error).toContain('仅支持')
  })
})