<!DOCTYPE html>
<meta charset="utf-8">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="helper.js" type="module"></script>

<script type="module">
  import { expireCookie, documentHasCookie, waitForCookie, addCookieAndSessionCleanup, setupShardedServerState, configureServer } from "./helper.js";

  promise_test(async t => {
    const testId = await setupShardedServerState();
    const expectedCookieAndValue1 = "auth_cookie=abcdef0123";
    const expectedAttributes1 = `Domain=${location.hostname};Path=/device-bound-session-credentials`;
    const expectedCookieAndAttributes1 = `${expectedCookieAndValue1};${expectedAttributes1}`;
    const expectedCookieAndValue2 = "other_cookie=ghijkl4567";
    const expectedAttributes2 = `Domain=${location.hostname};Path=/device-bound-session-credentials`;
    const expectedCookieAndAttributes2 = `${expectedCookieAndValue2};${expectedAttributes2}`;
    addCookieAndSessionCleanup(t);

    // Configure server to set two cookies in the session instruction credentials.
    await configureServer({ cookieDetails: [
      { nameAndValue: expectedCookieAndValue2, attributes: expectedAttributes2 },
      { nameAndValue: expectedCookieAndValue1, attributes: expectedAttributes1 },
    ]});

    // Prompt starting a session, and wait until registration completes.
    const loginResponse = await fetch('login.py');
    assert_equals(loginResponse.status, 200);
    await waitForCookie(expectedCookieAndValue1, /*expectCookie=*/true);
    await waitForCookie(expectedCookieAndValue2, /*expectCookie=*/true);

    // Confirm that requests have the cookies set.
    const authResponse = await fetch('verify_authenticated.py', {
      method: 'POST',
      body: expectedCookieAndValue1
    });
    assert_equals(authResponse.status, 200);
    const alternateAuthResponse = await fetch('verify_authenticated.py', {
      method: 'POST',
      body: expectedCookieAndValue2
    });
    assert_equals(alternateAuthResponse.status, 200);

    async function triggerRefreshAndCheckBothCookies() {
      const authResponseAfterExpiry = await fetch('verify_authenticated.py');
      assert_equals(authResponseAfterExpiry.status, 200);
      assert_true(documentHasCookie(expectedCookieAndValue1));
      assert_true(documentHasCookie(expectedCookieAndValue2));
    }
    // Confirm that expiring the cookies still leads to a request with the cookie set (refresh occurs).
    // Just cookie 1.
    expireCookie(expectedCookieAndAttributes1);
    assert_false(documentHasCookie(expectedCookieAndValue1));
    await triggerRefreshAndCheckBothCookies();

    // Just cookie 2.
    expireCookie(expectedCookieAndAttributes2);
    assert_false(documentHasCookie(expectedCookieAndValue2));
    await triggerRefreshAndCheckBothCookies();

    // Both cookies.
    expireCookie(expectedCookieAndAttributes1);
    expireCookie(expectedCookieAndAttributes2);
    assert_false(documentHasCookie(expectedCookieAndValue1));
    assert_false(documentHasCookie(expectedCookieAndValue2));
    await triggerRefreshAndCheckBothCookies();
  }, "A session can have multiple credentials set");
</script>