/**
 * The other two columns of the same table: what an in-page script reaches when
 * the token is kept in localStorage, and when it is kept in a cookie without
 * HttpOnly. Measured the same way as the BFF column, so the comparison is
 * three measurements rather than one measurement and two assertions.
 *
 *   node bench/bff/storage.mjs > bench/bff/storage.json
 */
import http from "node:http";
import { chromium } from "@playwright/test";

const TOKEN = "tok_1f3a9c8e2b7d4a06";

const server = http.createServer((req, res) => {
  if (req.url.startsWith("/set")) {
    // A cookie without HttpOnly: exactly what a framework hands you when the
    // flag is left off.
    res.setHeader("Set-Cookie", [`readable_session=${TOKEN}; Path=/; SameSite=Lax`]);
  }
  res.setHeader("Content-Type", "text/html; charset=utf-8");
  res.end(`<!doctype html><meta charset="utf-8"><title>probe</title>
<script>localStorage.setItem("access_token", ${JSON.stringify(TOKEN)});</script>`);
});
await new Promise((r) => server.listen(0, "127.0.0.1", r));
const port = server.address().port;

const browser = await chromium.launch({
  executablePath: process.env.PLAYWRIGHT_CHROMIUM_PATH || undefined,
});
const page = await browser.newPage();
await page.goto(`http://127.0.0.1:${port}/set`);

// The one line an injected script needs in each case.
const reach = await page.evaluate(() => ({
  fromLocalStorage: localStorage.getItem("access_token"),
  fromDocumentCookie: document.cookie,
}));

await browser.close();
server.close();

process.stdout.write(
  JSON.stringify({ plantedToken: TOKEN, reach, recordedAt: new Date().toISOString() }, null, 2),
);