import { expect, it, vi } from "vitest";
import { SourcesRuntime } from "../src/modules/sources-identity/runtime.ts";

it("签名下载的 credentials omit 不复用账号或浏览器Cookie", async () => {
  let sent = new Headers();
  const rt = new SourcesRuntime({} as never, {
    fetch: async (_input, init) => {
      sent = new Headers(init?.headers);
      return new Response("subtitle bytes");
    },
  });
  const browser = vi.spyOn(rt.cloudflare, "handle");
  const fetch = rt.siteFetch({ id: "original-site", proxy: false }, undefined, "Site User Agent");
  const headers = { cookie: "account-cookie", authorization: "account-token" };
  const url = "https://signed-cdn.example/file?credential=ephemeral";
  const response = await fetch(url, { headers, credentials: "omit" });
  expect(await response.text()).toBe("subtitle bytes");
  expect(sent.has("cookie")).toBe(false);
  expect(sent.has("authorization")).toBe(false);
  expect(sent.get("user-agent")).toBe("Site User Agent");
  expect(browser).not.toHaveBeenCalled();
});