<?php

namespace Tests\Unit;

use App\Services\ApplicationUrlService;
use App\Services\Auth\AuthSessionService;
use PHPUnit\Framework\TestCase;

class AuthSessionServiceTest extends TestCase
{
    private AuthSessionService $svc;

    protected function setUp(): void
    {
        parent::setUp();
        // ApplicationUrlService is final (cannot be mocked); these tests only exercise
        // relative-path sanitization and never call docsHomeUrl().
        $this->svc = new AuthSessionService(new ApplicationUrlService);
    }

    public function test_sanitize_redirect_relative(): void
    {
        $this->assertSame('/dashboard', $this->svc->sanitizeRedirectTarget('/dashboard'));
        $this->assertSame('/dash?q=1', $this->svc->sanitizeRedirectTarget('/dash?q=1'));
    }

    public function test_sanitize_redirect_empty(): void
    {
        $this->assertNull($this->svc->sanitizeRedirectTarget(''));
        $this->assertNull($this->svc->sanitizeRedirectTarget('   '));
    }

    public function test_sanitize_rejects_protocol_relative(): void
    {
        $this->assertNull($this->svc->sanitizeRedirectTarget('//evil.example/path'));
    }
}