/**
 * MfaSetup security contract tests
 *
 * These tests verify the static source of MfaSetup.tsx to ensure the TOTP
 * secret and otpauth:// URI are never transmitted to an external QR-code
 * rendering service.
 *
 * Static source analysis is intentionally used here rather than a full React
 * render test because:
 * - The vitest environment for apps/web is "node" (not jsdom).
 * - The security property being asserted is structural (absence of external
 *   URLs), not behavioural, making source-level assertion appropriate.
 * - A render test would require a full React + browser environment and would
 *   be fragile against irrelevant UI changes.
 */
import { readFileSync } from "node:fs";
import { resolve } from "node:path";
import { describe, expect, it } from "vitest";

const SOURCE_PATH = resolve(__dirname, "./MfaSetup.tsx");
const source = readFileSync(SOURCE_PATH, "utf-8");

describe("MfaSetup — no external QR-code service", () => {
  it("does not reference api.qrserver.com", () => {
    expect(source).not.toMatch(/qrserver\.com/);
  });

  it("does not reference chart.googleapis.com", () => {
    expect(source).not.toMatch(/chart\.googleapis\.com/);
  });

  it("does not reference any known external QR-generation service", () => {
    // Guard against known external QR APIs and generic patterns
    expect(source).not.toMatch(/https?:\/\/[^'"]*qr[^'"]*\.(com|io|dev)[^'"]*uri/i);
  });

  it("imports the local qrcode package for offline generation", () => {
    expect(source).toMatch(/import\s+QRCode\s+from\s+['"]qrcode['"]/);
  });

  it("generates the QR code as a data URL (stays in-browser, no network request)", () => {
    expect(source).toMatch(/QRCode\.toDataURL/);
  });
});
