const test = require('node:test');
const assert = require('node:assert/strict');
const { publicAppUrl } = require('../src/security/publicAppUrl');

test('public application URL comes from trusted configuration', () => {
  assert.equal(publicAppUrl({ PUBLIC_APP_URL: 'https://coach.example.co/path', NODE_ENV: 'production' }), 'https://coach.example.co');
  assert.equal(publicAppUrl({ FULL_DOMAIN: 'workspace.example.co', NODE_ENV: 'production' }), 'https://workspace.example.co');
});

test('public application URL rejects insecure production configuration', () => {
  assert.throws(() => publicAppUrl({ PUBLIC_APP_URL: 'http://workspace.example.co', NODE_ENV: 'production' }));
  assert.throws(() => publicAppUrl({ NODE_ENV: 'production' }));
});