import { describe, expect, it } from 'vitest';

import { isAllowedCorsOrigin } from '../cors';

describe('isAllowedCorsOrigin', () => {
  it('allows requests without an Origin header', () => {
    expect(isAllowedCorsOrigin(undefined, ['https://rainmakersports.app'])).toBe(true);
  });

  it('allows configured origins', () => {
    expect(isAllowedCorsOrigin('https://rainmakersports.app', ['https://rainmakersports.app'])).toBe(true);
  });

  it('rejects unknown origins', () => {
    expect(isAllowedCorsOrigin('https://evil.example', ['https://rainmakersports.app'])).toBe(false);
  });
});