// @vitest-environment jsdom
import { describe, expect, it, vi } from "vitest";

import { installAuditFetch } from "./audit-fetch";

describe("installAuditFetch", () => {
  it("tags same-origin /api/ calls only, without overriding an explicit header", async () => {
    const calls: Array<{ url: string; headers: Headers }> = [];
    window.fetch = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
      calls.push({ url: String(input), headers: new Headers(init?.headers) });
      return new Response("{}");
    }) as typeof fetch;

    let token = "tok-1";
    installAuditFetch(() => token);
    installAuditFetch(() => "second-install-ignored");

    await fetch("/api/v1/orders/1/detail", { headers: { Authorization: "x" } });
    await fetch("https://elsewhere.example/api/x");
    await fetch("/not-api");
    await fetch("/api/v1/x", { headers: { "x-wfdash-auth": "explicit" } });
    token = "";
    await fetch("/api/v1/y");

    expect(calls[0].headers.get("x-wfdash-auth")).toBe("tok-1");
    expect(calls[0].headers.get("authorization")).toBe("x");
    expect(calls[1].headers.get("x-wfdash-auth")).toBeNull();
    expect(calls[2].headers.get("x-wfdash-auth")).toBeNull();
    expect(calls[3].headers.get("x-wfdash-auth")).toBe("explicit");
    expect(calls[4].headers.get("x-wfdash-auth")).toBeNull();
  });
});