import { describe, expect, it } from 'vitest';
import { getClientIp, isResolvedIp } from '../../security/client-ip.js';
function req(headers) {
    return new Request('https://example.com/x', { headers });
}
describe('client-ip helper', () => {
    it('uses X-Vercel-Forwarded-For first', () => {
        const r = req({
            'x-vercel-forwarded-for': '203.0.113.5',
            'x-forwarded-for': '198.51.100.1, 203.0.113.5',
            'x-real-ip': '198.51.100.1',
        });
        expect(getClientIp(r)).toBe('203.0.113.5');
    });
    it('falls back to x-real-ip when no Vercel header', () => {
        const r = req({ 'x-real-ip': '203.0.113.99' });
        expect(getClientIp(r)).toBe('203.0.113.99');
    });
    it('does NOT trust X-Forwarded-For by default', () => {
        const r = req({ 'x-forwarded-for': '1.2.3.4' });
        expect(getClientIp(r)).toBe('unknown');
    });
    it('uses the LAST X-Forwarded-For entry when trustProxy is enabled', () => {
        const r = req({ 'x-forwarded-for': '198.51.100.1, 203.0.113.5, 1.2.3.4' });
        // Last entry = closest to our trusted proxy = the one to trust.
        expect(getClientIp(r, { trustProxy: true })).toBe('1.2.3.4');
    });
    it('reports "unknown" with no headers', () => {
        expect(getClientIp(req({}))).toBe('unknown');
    });
    it('isResolvedIp is false for "unknown"', () => {
        expect(isResolvedIp('unknown')).toBe(false);
        expect(isResolvedIp('')).toBe(false);
        expect(isResolvedIp('203.0.113.5')).toBe(true);
    });
});
//# sourceMappingURL=client-ip.test.js.map