"""Tests for stateless checker helpers."""
import pytest
from scanner.checker import (
    check_links_against_whitelist,
    check_security_headers,
    is_suspicious_url,
)


class TestIsSuspiciousUrl:
    @pytest.mark.parametrize("url", [
        "https://b.info/uploads/shell.php",
        "https://b.info/c99.php",
        "https://b.info/wso.aspx",
        "https://b.info/admin/backdoor.php",
        "https://b.info/webshell.php",
    ])
    def test_flags_webshell_names(self, url):
        assert is_suspicious_url(url) is True

    @pytest.mark.parametrize("url", [
        "https://b.info/index.html",
        "https://b.info/css/app.css",
        "https://b.info/impressum",
        "https://b.info/team/photo.jpg",
        # Regression: legitimate site assets must NOT be flagged
        "https://b.info/assets/js/PSEMailerAntispam.js",
        "https://b.info/navigate.php",
        "https://b.info/uploads/document.pdf",
    ])
    def test_ignores_normal_names(self, url):
        assert is_suspicious_url(url) is False


class TestSecurityHeaders:
    def test_reports_missing(self):
        present = {"Content-Type": "text/html"}
        missing = check_security_headers(present, ["Content-Security-Policy", "X-Content-Type-Options"])
        assert "Content-Security-Policy" in missing

    def test_case_insensitive(self):
        present = {"content-security-policy": "default-src 'self'"}
        missing = check_security_headers(present, ["Content-Security-Policy"])
        assert missing == []


class TestWhitelist:
    def _page(self, ext_url):
        return {
            "links": {"a": [{"url": ext_url, "class": "external"}]},
            "comment_links": [],
            "hidden_content": [],
        }

    def test_flags_unlisted_domain(self):
        page = self._page("https://spam.example.com/x")
        violations = check_links_against_whitelist(page, set(), "b.info")
        assert any(v["domain"] == "spam.example.com" for v in violations)

    def test_allows_listed_domain(self):
        page = self._page("https://good.example.com/x")
        violations = check_links_against_whitelist(page, {"good.example.com"}, "b.info")
        assert violations == []