/**
 * GATE 4 — Token tests
 */

import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import {
  issueSessionToken,
  parseSessionToken,
  generateApiKey,
  isApiKey,
  extractBearerToken,
} from '../../src/lib/tokens.js';
import { config } from '../../src/config.js';

describe('tokens', () => {
  it('issues and parses session tokens', () => {
    const token = issueSessionToken({
      tenantId: 't1',
      veraeToken: 'mock-jwt-user',
      expiresAt: '2099-01-01T00:00:00Z',
    });
    assert.ok(token.startsWith('zmt_'));
    const parsed = parseSessionToken(token);
    assert.equal(parsed.tenantId, 't1');
    assert.equal(parsed.veraeToken, 'mock-jwt-user');
  });

  it('rejects forged session tokens', () => {
    const token = issueSessionToken({
      tenantId: 't1',
      veraeToken: 'secret',
    });
    const forged = token.slice(0, -4) + 'xxxx';
    assert.equal(parseSessionToken(forged), null);
  });

  it('rejects tokens signed with wrong secret', () => {
    const token = issueSessionToken({
      tenantId: 't1',
      veraeToken: 'secret',
    });
    const original = config.tokenSecret;
    config.tokenSecret = 'other-secret';
    assert.equal(parseSessionToken(token), null);
    config.tokenSecret = original;
  });

  it('generates api keys and extracts bearer', () => {
    const key = generateApiKey();
    assert.ok(isApiKey(key));
    assert.equal(extractBearerToken(`Bearer ${key}`), key);
    assert.equal(extractBearerToken(undefined), null);
  });
});