1  import { describe, expect, it } from 'vitest';
 2  
 3  import { getResponseCorsHeaders } from './daemon.js';
 4  
 5  describe('getResponseCorsHeaders', () => {
 6    it('allows the Browser Bridge extension origin to read /ping', () => {
 7      expect(getResponseCorsHeaders('/ping', 'chrome-extension://abc123')).toEqual({
 8        'Access-Control-Allow-Origin': 'chrome-extension://abc123',
 9        Vary: 'Origin',
10      });
11    });
12  
13    it('does not add CORS headers for ordinary web origins', () => {
14      expect(getResponseCorsHeaders('/ping', 'https://example.com')).toBeUndefined();
15    });
16  
17    it('does not add CORS headers when origin is absent', () => {
18      expect(getResponseCorsHeaders('/ping')).toBeUndefined();
19    });
20  
21    it('does not add CORS headers for command endpoints even from the extension origin', () => {
22      expect(getResponseCorsHeaders('/command', 'chrome-extension://abc123')).toBeUndefined();
23    });
24  });