import { describe, expect, it } from "vitest";
import { checkRateLimit, clientKeyFromHeaders, MAX_IN_FLIGHT_INSPECTIONS, RATE_LIMIT_MAX_REQUESTS, RATE_LIMIT_WINDOW_MS, tryAcquireInspection } from "./admission";

describe("inspection admission", () => {
  it("rejects work beyond the bounded in-flight budget", () => {
    const releases = Array.from({ length: MAX_IN_FLIGHT_INSPECTIONS }, () => tryAcquireInspection());

    expect(releases.every(Boolean)).toBe(true);
    expect(tryAcquireInspection()).toBeNull();

    releases.forEach((release) => release?.());
    const release = tryAcquireInspection();
    expect(release).not.toBeNull();
    release?.();
  });

  it("releases capacity at most once", () => {
    const release = tryAcquireInspection();
    expect(release).not.toBeNull();
    release?.();
    release?.();

    const releases = Array.from({ length: MAX_IN_FLIGHT_INSPECTIONS }, () => tryAcquireInspection());
    expect(releases.every(Boolean)).toBe(true);
    releases.forEach((item) => item?.());
  });

  it("applies a bounded per-client sliding-window limit", () => {
    const key = "test-client-" + Math.random();
    const now = 1_000_000;
    for (let index = 0; index < RATE_LIMIT_MAX_REQUESTS; index += 1) {
      expect(checkRateLimit(key, now + index)).toMatchObject({ allowed: true });
    }
    expect(checkRateLimit(key, now + RATE_LIMIT_MAX_REQUESTS)).toMatchObject({ allowed: false });
    expect(checkRateLimit(key, now + RATE_LIMIT_WINDOW_MS + 1)).toMatchObject({ allowed: true });
  });

  it("does not trust forwarded client identity unless proxy trust is enabled", () => {
    const headers = { get: (name: string) => name === "x-forwarded-for" ? "198.51.100.10, 10.0.0.1" : null };
    const previous = process.env.CERTSCOPE_TRUST_PROXY;
    delete process.env.CERTSCOPE_TRUST_PROXY;
    expect(clientKeyFromHeaders(headers)).toBe("direct");
    process.env.CERTSCOPE_TRUST_PROXY = "true";
    expect(clientKeyFromHeaders(headers)).toBe("proxy:198.51.100.10");
    if (previous === undefined) delete process.env.CERTSCOPE_TRUST_PROXY;
    else process.env.CERTSCOPE_TRUST_PROXY = previous;
  });
});