@danj/audible-auth

import assert from 'node:assert/strict'
import { test } from 'node:test'
import { buildQuery, isAllowedBody, isAllowedCall, refreshFormBody } from '../policy.ts'

test('allows only the Library and Wishlist calls', () => {
	assert.ok(isAllowedCall('GET', '/1.0/library'))
	assert.ok(isAllowedCall('get', '/1.0/library/B002UZKI96'))
	assert.ok(isAllowedCall('GET', '/1.0/wishlist'))
	assert.ok(isAllowedCall('POST', '/1.0/wishlist'))
	assert.ok(isAllowedCall('DELETE', '/1.0/wishlist/B002UZKI96'))
	assert.ok(!isAllowedCall('POST', '/1.0/orders'))
	assert.ok(!isAllowedCall('POST', '/1.0/content/B002UZKI96/licenserequest'))
	assert.ok(!isAllowedCall('DELETE', '/1.0/library/B002UZKI96'))
	assert.ok(!isAllowedCall('GET', '/1.0/library?x=1'))
	assert.ok(!isAllowedCall('GET', '/1.0/library/../orders'))
})

test('a Wishlist add sends exactly one ASIN', () => {
	assert.ok(isAllowedBody('POST', '/1.0/wishlist', { asin: 'B002UZKI96' }))
	assert.ok(!isAllowedBody('POST', '/1.0/wishlist', { asin: 'B002UZKI96', extra: 1 }))
	assert.ok(!isAllowedBody('POST', '/1.0/wishlist', { asin: 'nope' }))
	assert.ok(isAllowedBody('GET', '/1.0/library', undefined))
	assert.ok(!isAllowedBody('GET', '/1.0/library', { a: 1 }))
})

test('query keys must be plain parameter names', () => {
	assert.equal(buildQuery({ num_results: 2, page: 0, empty: '' }), '?num_results=2&page=0')
	assert.throws(() => buildQuery({ 'bad-key': 1 }))
})

test('the refresh body keeps the placeholder unencoded', () => {
	const body = refreshFormBody('{{secret:audible-refresh-token|scope=package}}')
	assert.match(body, /source_token=\{\{secret:audible-refresh-token\|scope=package\}\}$/)
})