<?php

declare(strict_types=1);

namespace Tests\Feature\Cors;

use Tests\DatabaseTestCase;

class TenantCorsTest extends DatabaseTestCase
{
    public function testReflectsRegisteredTenantOriginOnPreflight(): void
    {
        $response = $this->withHeaders([
            'Origin' => 'https://demo.com',
            'Access-Control-Request-Method' => 'GET',
        ])->options('frontend/vehicles');

        $response->assertHeader('Access-Control-Allow-Origin', 'https://demo.com');
        $response->assertHeader('Access-Control-Allow-Credentials', 'true');
    }

    public function testDoesNotReflectUnknownOriginOnPreflight(): void
    {
        $response = $this->withHeaders([
            'Origin' => 'https://attacker.example',
            'Access-Control-Request-Method' => 'GET',
        ])->options('frontend/vehicles');

        $this->assertNotSame(
            'https://attacker.example',
            $response->headers->get('Access-Control-Allow-Origin')
        );
    }
}
