From 8c06f5decb8bb4c21f134bf8941ea7ced8436735 Mon Sep 17 00:00:00 2001
From: DualFroz <me@dualfroz.com>
Date: Thu, 10 Sep 2026 14:33:43 +0200
Subject: [PATCH] test: cover CorsDslTest and teardown

---
 test/test_cors.rb | 118 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 118 insertions(+)
 create mode 100644 test/test_cors.rb

diff --git a/test/test_cors.rb b/test/test_cors.rb
new file mode 100644
index 0000000..a964eaa
--- /dev/null
+++ b/test/test_cors.rb
@@ -0,0 +1,118 @@
+require 'minitest/autorun'
+require 'prism'
+
+class CorsDslTest < Minitest::Test
+  def setup
+    Prism::Cors.reset!
+  end
+
+  def teardown
+    Prism::Cors.reset!
+  end
+
+  def test_matches_allowed_origin_and_resource_pattern
+    Prism::Cors.configure do |config|
+      config.allow do
+        origins 'https://app.example.com'
+        resource '/api/*', methods: %w[GET POST]
+      end
+    end
+
+    rule, resource = Prism::Cors.resource_for('https://app.example.com', '/api/posts')
+    refute_nil rule
+    assert_equal %w[GET POST], resource.methods
+  end
+
+  def test_unmatched_origin_returns_nil
+    Prism::Cors.configure do |config|
+      config.allow do
+        origins 'https://app.example.com'
+        resource '/api/*'
+      end
+    end
+
+    assert_nil Prism::Cors.resource_for('https://evil.example.com', '/api/posts')
+  end
+
+  def test_unmatched_path_returns_nil_even_with_allowed_origin
+    Prism::Cors.configure do |config|
+      config.allow do
+        origins 'https://app.example.com'
+        resource '/api/*'
+      end
+    end
+
+    assert_nil Prism::Cors.resource_for('https://app.example.com', '/admin/secrets')
+  end
+
+  def test_wildcard_origin_matches_anything
+    Prism::Cors.configure do |config|
+      config.allow do
+        origins '*'
+        resource '/public/*'
+      end
+    end
+
+    refute_nil Prism::Cors.resource_for('https://anyone.example.com', '/public/feed')
+  end
+
+  def test_regexp_origin_matches
+    Prism::Cors.configure do |config|
+      config.allow do
+        origins(/\Ahttps:\/\/.*\.example\.com\z/)
+        resource '/api/*'
+      end
+    end
+
+    refute_nil Prism::Cors.resource_for('https://sub.example.com', '/api/posts')
+    assert_nil Prism::Cors.resource_for('https://sub.example.org', '/api/posts')
+  end
+
+  def test_first_matching_rule_wins_when_multiple_rules_allow_the_origin
+    Prism::Cors.configure do |config|
+      config.allow do
+        origins '*'
+        resource '/api/*', methods: %w[GET]
+      end
+      config.allow do
+        origins '*'
+        resource '/api/*', methods: %w[GET POST DELETE]
+      end
+    end
+
+    _rule, resource = Prism::Cors.resource_for('https://x.example.com', '/api/posts')
+    assert_equal %w[GET], resource.methods
+  end
+
+  def test_reset_clears_every_rule
+    Prism::Cors.configure { |config| config.allow { origins '*'; resource '/api/*' } }
+    Prism::Cors.reset!
+    assert_empty Prism::Cors.configuration.rules
+  end
+end
+
+class CorsResourceTest < Minitest::Test
+  def test_allows_headers_any_accepts_everything
+    resource = Prism::Cors::Resource.new('/api/*', headers: :any)
+    assert resource.allows_headers?('X-Custom-Header, Authorization')
+  end
+
+  def test_allows_headers_checks_each_requested_header_case_insensitively
+    resource = Prism::Cors::Resource.new('/api/*', headers: %w[Authorization X-Request-Id])
+    assert resource.allows_headers?('authorization, x-request-id')
+    refute resource.allows_headers?('authorization, x-secret')
+  end
+
+  def test_allows_headers_with_blank_request_is_always_true
+    resource = Prism::Cors::Resource.new('/api/*', headers: %w[Authorization])
+    assert resource.allows_headers?(nil)
+    assert resource.allows_headers?('')
+  end
+
+  def test_allows_method_is_case_insensitive_on_registration
+    resource = Prism::Cors::Resource.new('/api/*', methods: %w[get post])
+    assert resource.allows_method?('GET')
+    assert resource.allows_method?('post')
+    refute resource.allows_method?('DELETE')
+  end
+end