// 功能描述：验证登录目标页构造、站内地址校验及开放重定向防护。
// 版本：1.0.0
import 'package:flutter_test/flutter_test.dart';
import 'package:user_app/app/auth_navigation.dart';

/// 覆盖合法深链接、鉴权页循环和外部地址攻击场景。
void main() {
  test('保留站内目标页的路径、查询参数和片段', () {
    const target = '/orders?status=pending#payment';

    expect(sanitizeRedirectTarget(target), target);
    final loginUri = Uri.parse(
      buildAuthLocation(
        '/login',
        redirectTarget: target,
        sessionExpired: true,
      ),
    );
    expect(loginUri.path, '/login');
    expect(loginUri.queryParameters['redirect'], target);
    expect(loginUri.queryParameters['reason'], 'expired');
  });

  test('拒绝外部地址、协议相对地址和鉴权页循环', () {
    expect(sanitizeRedirectTarget('https://example.com/orders'), isNull);
    expect(sanitizeRedirectTarget('//example.com/orders'), isNull);
    expect(sanitizeRedirectTarget(r'/\example.com/orders'), isNull);
    expect(sanitizeRedirectTarget('/login'), isNull);
    expect(sanitizeRedirectTarget('/register?redirect=/orders'), isNull);
  });

  test('非法目标页不写入登录地址', () {
    final loginUri = Uri.parse(
      buildAuthLocation('/login', redirectTarget: 'https://example.com'),
    );

    expect(loginUri.path, '/login');
    expect(loginUri.queryParameters, isEmpty);
  });
}