import { request } from 'node:http'

const PORT = 3101

function wsUpgrade(origin) {
  return new Promise((resolve) => {
    const req = request({
      host: 'localhost',
      port: PORT,
      path: '/',
      headers: {
        Connection: 'Upgrade',
        Upgrade: 'websocket',
        'Sec-WebSocket-Key': 'dGhlIHNhbXBsZSBub25jZQ==',
        'Sec-WebSocket-Version': '13',
        ...(origin ? { Origin: origin } : {}),
      },
    })
    req.on('response', (res) => resolve({ status: res.statusCode }))
    req.on('error', () => resolve({ status: 'destroyed' }))
    req.end()
  })
}

const { WebSocket } = await import('ws')

function wsOpen(origin, sendCreate) {
  return new Promise((resolve) => {
    const ws = new WebSocket(`ws://localhost:${PORT}`, origin ? { origin } : undefined)
    const done = (ok, info) => {
      try { ws.close() } catch {}
      resolve({ ok, info })
    }
    ws.on('open', () => {
      if (sendCreate) ws.send(JSON.stringify({ t: 'create', mode: 'coop', name: 'Test' }))
      else done(true, 'connected')
    })
    ws.on('message', (d) => {
      const m = JSON.parse(d.toString())
      if (m.t === 'room') done(true, 'room ' + m.code)
      if (m.t === 'error') done(false, m.msg)
    })
    ws.on('error', () => done(false, 'error'))
    setTimeout(() => resolve({ ok: false, info: 'timeout' }), 3000)
  })
}

// 1) böser Origin → 403
const evil = await wsUpgrade('https://boese-seite.example.com')
console.log('1) Origin-Check böser Origin :', evil.status === 403 ? 'OK (403)' : `FEHLER (${evil.status})`)

// 2) same-origin → erlaubt
const same = await wsOpen('http://localhost:' + PORT, false)
console.log('2) Same-Origin               :', same.ok ? 'OK' : 'FEHLER ' + same.info)

// 3) dev-origin (localhost:5173) → erlaubt
const dev = await wsOpen('http://localhost:5173', false)
console.log('3) Dev-Origin (:5173)        :', dev.ok ? 'OK' : 'FEHLER ' + dev.info)

// 4) ohne Origin + Raum erstellen
const plain = await wsOpen(undefined, true)
console.log('4) Non-Browser + Raum         :', plain.ok ? 'OK (' + plain.info + ')' : 'FEHLER ' + plain.info)

process.exit(0)