import { describe, expect, it } from "@effect/vitest"; import { browserOriginFromRequest } from "./request-origin"; const req = (url: string, headers: Record<string, string> = {}): Request =>  new Request(url, { headers }); describe("browserOriginFromRequest", () => {  it("uses the request URL origin when no proxy headers are present (Cloudflare)", () => {    expect(browserOriginFromRequest(req("https://executor.sh/acme/policies"))).toBe(      "https://executor.sh",    );  });   it("honors X-Forwarded-Proto to recover https behind a TLS-terminating proxy", () => {    // tailscale serve / nginx: browser on https, upstream request is http.    expect(      browserOriginFromRequest(        req("http://mac-mini.tail5665af.ts.net:47130/acme/policies", {          "x-forwarded-proto": "https",        }),      ),    ).toBe("https://mac-mini.tail5665af.ts.net:47130");  });   it("honors X-Forwarded-Host when the proxy rewrites the host", () => {    expect(      browserOriginFromRequest(        req("http://127.0.0.1:8080/", {          "x-forwarded-proto": "https",          "x-forwarded-host": "executor.sh",        }),      ),    ).toBe("https://executor.sh");  });   it("takes the first value of a comma-listed forwarded chain", () => {    expect(      browserOriginFromRequest(        req("http://internal:8080/", {          "x-forwarded-proto": "https, http",          "x-forwarded-host": "executor.sh, internal",        }),      ),    ).toBe("https://executor.sh");  });   it("falls back to the request scheme/host for the half-set header", () => {    // Only proto forwarded: keep the request's own host.    expect(      browserOriginFromRequest(req("http://localhost:43130/", { "x-forwarded-proto": "https" })),    ).toBe("https://localhost:43130");    // Only host forwarded: keep the request's own scheme.    expect(      browserOriginFromRequest(        req("http://localhost:43130/", { "x-forwarded-host": "executor.sh" }),      ),    ).toBe("http://executor.sh");  });});