// Package auth_test tests access token issuance and parsing.
package auth_test

import (
	"errors"
	"testing"
	"time"

	"github.com/golang-jwt/jwt/v5"
	"messenger/internal/auth"
)

func TestIssueParseRoundTrip(t *testing.T) {
	secret := "0123456789abcdef0123456789abcdef"
	tm := auth.NewTokenManager(secret)
	token, err := tm.IssueAccessToken(42, time.Minute)
	if err != nil {
		t.Fatalf("IssueAccessToken error: %v", err)
	}
	uid, err := tm.ParseAccessToken(token)
	if err != nil {
		t.Fatalf("ParseAccessToken error: %v", err)
	}
	if uid != 42 {
		t.Fatalf("expected userID 42, got %d", uid)
	}
}

func TestInvalidSignature(t *testing.T) {
	tm1 := auth.NewTokenManager("secret1secret1secret1secret1sec1")
	tm2 := auth.NewTokenManager("secret2secret2secret2secret2sec2")
	token, err := tm1.IssueAccessToken(1, time.Minute)
	if err != nil {
		t.Fatalf("IssueAccessToken error: %v", err)
	}
	_, err = tm2.ParseAccessToken(token)
	if !errors.Is(err, auth.ErrInvalidToken) {
		t.Fatalf("expected ErrInvalidToken, got %v", err)
	}
}

func TestExpiredToken(t *testing.T) {
	tm := auth.NewTokenManager("secretsecretsecretsecretsecretse")
	token, err := tm.IssueAccessToken(1, -time.Minute)
	if err != nil {
		t.Fatalf("IssueAccessToken error: %v", err)
	}
	_, err = tm.ParseAccessToken(token)
	if !errors.Is(err, auth.ErrInvalidToken) {
		t.Fatalf("expected ErrInvalidToken for expired, got %v", err)
	}
}

func TestNoneAlgorithmToken(t *testing.T) {
	claims := jwt.RegisteredClaims{
		Subject:   "1",
		IssuedAt:  jwt.NewNumericDate(time.Now()),
		ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
	}
	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)
	tokenStr, err := token.SignedString(jwt.UnsafeAllowNoneSignatureType)
	if err != nil {
		t.Fatalf("create none token: %v", err)
	}
	tm := auth.NewTokenManager("longsecretlongsecretlongsecretlongsec")
	_, err = tm.ParseAccessToken(tokenStr)
	if !errors.Is(err, auth.ErrInvalidToken) {
		t.Fatalf("expected ErrInvalidToken for none alg, got %v", err)
	}
}

func TestGarbageToken(t *testing.T) {
	tm := auth.NewTokenManager("secretsecretsecretsecretsecretse")
	_, err := tm.ParseAccessToken("not a token")
	if !errors.Is(err, auth.ErrInvalidToken) {
		t.Fatalf("expected ErrInvalidToken for garbage token, got %v", err)
	}
}