package auth

import (
	"testing"
	"time"
)

func TestTokenRoundTrip(t *testing.T) {
	secret := []byte("test-secret-test-secret")
	tok, err := IssueToken(secret, 42, 3, time.Now())
	if err != nil {
		t.Fatal(err)
	}
	c, err := ParseToken(secret, tok)
	if err != nil {
		t.Fatal(err)
	}
	if c.UserID != 42 || c.TokenVersion != 3 {
		t.Errorf("claims = %+v", c)
	}
	if _, err := ParseToken([]byte("other-secret-other-secret"), tok); err == nil {
		t.Error("token accepted with wrong secret")
	}
	old, _ := IssueToken(secret, 42, 3, time.Now().Add(-8*24*time.Hour))
	if _, err := ParseToken(secret, old); err == nil {
		t.Error("expired token accepted")
	}
}

func TestPasswordAndCSRF(t *testing.T) {
	h, err := HashPassword("hunter22")
	if err != nil {
		t.Fatal(err)
	}
	if !CheckPassword(h, "hunter22") || CheckPassword(h, "hunter23") {
		t.Error("password check wrong")
	}
	secret := []byte("s")
	tok := CSRFToken(secret, 1, 0)
	if !CheckCSRF(secret, 1, 0, tok) {
		t.Error("valid csrf rejected")
	}
	if CheckCSRF(secret, 1, 1, tok) || CheckCSRF(secret, 2, 0, tok) || CheckCSRF(secret, 1, 0, "") {
		t.Error("invalid csrf accepted")
	}
}