defmodule ToweropsWeb.Plugs.SecurityHeadersTest do
  use ToweropsWeb.ConnCase, async: true

  alias ToweropsWeb.Plugs.SecurityHeaders

  describe "call/2" do
    test "adds security headers in production environment" do
      # Save original env
      original_env = Application.get_env(:towerops, :env)

      try do
        # Set environment to production
        Application.put_env(:towerops, :env, :prod)

        conn = SecurityHeaders.call(build_conn(), [])

        # Verify all security headers are present
        assert ["default-src 'self'" <> _] = get_resp_header(conn, "content-security-policy")
        assert ["SAMEORIGIN"] = get_resp_header(conn, "x-frame-options")
        assert ["nosniff"] = get_resp_header(conn, "x-content-type-options")

        assert ["strict-origin-when-cross-origin"] =
                 get_resp_header(conn, "referrer-policy")

        # Verify CSP contains required directives
        [csp] = get_resp_header(conn, "content-security-policy")
        assert csp =~ "default-src 'self'"
        assert csp =~ "script-src 'self' 'unsafe-inline' 'unsafe-eval'"
        assert csp =~ "style-src 'self' 'unsafe-inline' 'unsafe-hashes'"
        assert csp =~ "img-src 'self' data: https:"
        assert csp =~ "font-src 'self' data:"
        assert csp =~ "connect-src 'self' ws: wss:"
        assert csp =~ "frame-ancestors 'self'"
      after
        # Restore original env
        Application.put_env(:towerops, :env, original_env)
      end
    end

    test "does not add security headers in non-production environment" do
      # Default test environment is :test, not :prod
      conn = SecurityHeaders.call(build_conn(), [])

      # Verify no security headers are present
      assert [] = get_resp_header(conn, "content-security-policy")
      assert [] = get_resp_header(conn, "x-frame-options")
      assert [] = get_resp_header(conn, "x-content-type-options")
      assert [] = get_resp_header(conn, "referrer-policy")
    end

    test "does not add security headers in development environment" do
      # Save original env
      original_env = Application.get_env(:towerops, :env)

      try do
        # Set environment to development
        Application.put_env(:towerops, :env, :dev)

        conn = SecurityHeaders.call(build_conn(), [])

        # Verify no security headers are present
        assert [] = get_resp_header(conn, "content-security-policy")
        assert [] = get_resp_header(conn, "x-frame-options")
        assert [] = get_resp_header(conn, "x-content-type-options")
        assert [] = get_resp_header(conn, "referrer-policy")
      after
        # Restore original env
        Application.put_env(:towerops, :env, original_env)
      end
    end
  end
end