package webui

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

// TestSecurityHeadersSetOnEveryResponse confirms the hardening headers are present
// regardless of which underlying handler produced the response — admin, webmail, or
// anything else, since main.go wraps the whole app's handler once with this rather
// than per-route.
func TestSecurityHeadersSetOnEveryResponse(t *testing.T) {
	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
	handler := SecurityHeaders(inner)

	req := httptest.NewRequest(http.MethodGet, "/anything", nil)
	rec := httptest.NewRecorder()
	handler.ServeHTTP(rec, req)

	cases := map[string]string{
		"X-Content-Type-Options":  "nosniff",
		"X-Frame-Options":         "SAMEORIGIN",
		"Referrer-Policy":         "same-origin",
		"Content-Security-Policy": contentSecurityPolicy,
	}
	for header, want := range cases {
		if got := rec.Header().Get(header); got != want {
			t.Errorf("header %s = %q, want %q", header, got, want)
		}
	}
	if rec.Header().Get("Permissions-Policy") == "" {
		t.Error("expected a Permissions-Policy header")
	}
}