import { test } from 'node:test';
import assert from 'node:assert/strict';
import { sessionToken, cookieOk, headerOk, cookieHeader } from '../src/token.js';

test('cookie matches HMAC of staff key', () => {
  const tok = sessionToken();
  assert.equal(tok.length, 64);
  assert.equal(cookieOk({ headers: { cookie: `staff_session=${tok}` } }), true);
  assert.equal(cookieOk({ headers: { cookie: 'staff_session=nope' } }), false);
  assert.equal(headerOk({ headers: { 'x-staff-key': process.env.STAFF_KEY || 'admin-dev-key' } }), true);
});

test('cookie Domain is optional', () => {
  delete process.env.STAFF_COOKIE_DOMAIN;
  assert.equal(cookieHeader().includes('Domain='), false);
  process.env.STAFF_COOKIE_DOMAIN = '.example.com';
  assert.match(cookieHeader(), /Domain=\.example.com/);
  delete process.env.STAFF_COOKIE_DOMAIN;
});