import { describe, expect, it } from 'vitest'
import { normalizeNextPath } from '../auth/next-path'

describe('normalizeNextPath', () => {
  it('keeps safe in-app next paths, including query and hash segments', () => {
    expect(normalizeNextPath('/app/downloads?platform=windows#desktop-link')).toBe('/app/downloads?platform=windows#desktop-link')
  })

  it('falls back when next is missing, external, or protocol-relative', () => {
    expect(normalizeNextPath('', '/app')).toBe('/app')
    expect(normalizeNextPath(null, '/app')).toBe('/app')
    expect(normalizeNextPath('https://evil.example', '/app')).toBe('/app')
    expect(normalizeNextPath('//evil.example', '/app')).toBe('/app')
  })

  it('supports an empty-string fallback for call sites that prefer nullish handling', () => {
    expect(normalizeNextPath('//evil.example', '')).toBe('')
  })
})
