import { describe, it, expect } from 'vitest';
import { readFileSync } from 'node:fs';
import { createHash } from 'node:crypto';
import { join } from 'node:path';
import { THEME_SCRIPT_HASH } from '../csp-config.js';

// The theme-flash-prevention <script> in app.html runs inline, so the CSP
// script-src must allow it by hash. SvelteKit's kit.csp hash mode does NOT
// cover app.html template scripts (only what it injects into %sveltekit.head%),
// so we pin the hash by hand in svelte.config.js. This test recomputes the hash
// from the actual app.html bytes and fails if THEME_SCRIPT_HASH drifted — i.e.
// someone edited the theme script without updating the CSP, which would silently
// CSP-block it (theme flash returns, only a console error to show for it).
describe('CSP theme-script hash', () => {
    it('matches the current inline theme script in app.html', () => {
        // vitest runs with cwd at the frontend package root.
        const html = readFileSync(join(process.cwd(), 'src/app.html'), 'utf-8');
        const match = html.match(/<script>(.*?)<\/script>/s);
        expect(match, 'app.html must contain an inline <script>').not.toBeNull();
        const digest = createHash('sha256')
            .update(match![1], 'utf-8')
            .digest('base64');
        expect(THEME_SCRIPT_HASH).toBe(`'sha256-${digest}'`);
    });
});