package auth

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestStaticHandlerServesCSS(t *testing.T) {
	h := StaticHandler()
	req := httptest.NewRequest(http.MethodGet, "/static/css/main.css", nil)
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want 200", rec.Code)
	}
	if ct := rec.Header().Get("Content-Type"); !strings.Contains(ct, "text/css") {
		t.Fatalf("Content-Type = %q, want text/css", ct)
	}
	if cc := rec.Header().Get("Cache-Control"); cc != "public, max-age=3600" {
		t.Fatalf("Cache-Control = %q, want public, max-age=3600", cc)
	}
	if rec.Body.Len() == 0 {
		t.Fatal("CSS 內容不應為空")
	}
}

func TestStaticHandlerRejectsTraversal(t *testing.T) {
	h := StaticHandler()
	// FileServer 以路徑對應 embed FS,目錄外不存在任何檔案,穿越應得到 404。
	req := httptest.NewRequest(http.MethodGet, "/static/../main.go", nil)
	req.URL.Path = "/static/../main.go"
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != http.StatusNotFound {
		t.Fatalf("status = %d, want 404", rec.Code)
	}
}