'use strict'

const test = require('./test')

test('redirect from http to https', function *(assert, {app, client}) {
  app.env = 'production'
  app.use(function *() { this.status = 200 })

  const response = yield client
    .get('/')
    .set('x-forwarded-proto', 'http')
    .send()

  response.expect(302).expect('location', 'https://localhost/')
})

test('pass through https to next handler', function *(assert, {app, client}) {
  app.env = 'production'
  app.use(function *() { this.status = 200 })

  const response = yield client
    .get('/')
    .set('x-forwarded-proto', 'https')
    .send()

  response.expect(200)
})

test('HSTS headers regardless of content type', function *(assert, {app, client}) {
  app.env = 'production'
  app.use(function *() {
    this.status = 200
    this.body = this.accepts('html') ? '' : {}
  })

  const html = yield client
    .get('/')
    .set('x-forwarded-proto', 'https')
    .accept('text/html')
    .send()

  html
    .expect(200)
    .expect('strict-transport-security', 'max-age=2592000; includeSubDomains')

  const json = yield client
    .get('/')
    .set('x-forwarded-proto', 'https')
    .accept('application/json')
    .send()

  json
    .expect(200)
    .expect('strict-transport-security', 'max-age=2592000; includeSubDomains')
})

test('security headers', function *(assert, {app, client}) {
  app.use(function *() { this.status = 200 })

  const response = yield client.get('/').send()
  response
    .expect(200)
    .expect('x-frame-options', 'SAMEORIGIN')
    .expect('x-xss-protection', '1; mode=block')
    .expect('x-content-type-options', 'nosniff')
    .expect('content-security-policy', /img-src[^;]+'self'/)
    .expect('content-security-policy', /frame-src[^;]+'self'/)
    .expect('content-security-policy', /style-src[^;]+'self'/)
    .expect('content-security-policy', /script-src[^;]+'self'/)
    .expect('content-security-policy', /connect-src[^;]+'self'/)
    .expect('content-security-policy', /default-src[^;]+'self'/)
    .expect('content-security-policy', /img-src[^;]+https:\/\/www.google-analytics.com/)
    .expect('content-security-policy', /script-src[^;]+https:\/\/www.google-analytics.com/)
})

@@ -647,33 +647,24 @@
 ers 
-regardless of content typ
+for HTML respons
 e', 
@@ -752,79 +752,23 @@
 () %7B
-%0A    this.status = 200%0A    this.body = this.accepts('html') ? '' : %7B%7D%0A 
+ this.body = ''
  %7D)%0A
@@ -776,20 +776,24 @@
   const 
-html
+response
  = yield
@@ -857,33 +857,8 @@
 s')%0A
-    .accept('text/html')%0A
     
@@ -872,12 +872,16 @@
 %0A%0A  
-html
+response
 %0A   
@@ -977,21 +977,172 @@
 s')%0A
-%0A  const json
+%7D)%0A%0Atest('HSTS headers for JSON response', function *(assert, %7Bapp, client%7D) %7B%0A  app.env = 'production'%0A  app.use(function *() %7B this.body = %7B%7D %7D)%0A%0A  const response
  = y
@@ -1210,40 +1210,8 @@
 s')%0A
-    .accept('application/json')%0A
     
@@ -1225,12 +1225,16 @@
 %0A%0A  
-json
+response
 %0A   

Split 'em up.