package auth

import (
	"context"
	"testing"

	"bookra/apps/backend/internal/db"
)

func TestLocalTokensVerifyWithIssuerAndAudience(t *testing.T) {
	repo := db.NewMemoryRepository()
	secret := "test-secret-that-is-long-enough"
	svc := NewService(repo, secret)

	_, tokens, err := svc.RegisterWithPassword(context.Background(), "user@example.com", "password123", "Test User")
	if err != nil {
		t.Fatalf("register: %v", err)
	}

	verifier, err := NewVerifier("", secret)
	if err != nil {
		t.Fatalf("create verifier: %v", err)
	}
	defer verifier.Close()

	claims, err := verifier.Verify(tokens.AccessToken)
	if err != nil {
		t.Fatalf("verify access token: %v", err)
	}
	if iss, _ := claims["iss"].(string); iss != tokenIssuer {
		t.Fatalf("expected issuer %s, got %v", tokenIssuer, claims["iss"])
	}
	if sub, _ := claims["sub"].(string); sub == "" {
		t.Fatal("expected non-empty sub")
	}
}

func TestLocalVerifierRejectsTamperedAndWrongTypeTokens(t *testing.T) {
	repo := db.NewMemoryRepository()
	secret := "test-secret-that-is-long-enough"
	svc := NewService(repo, secret)

	_, tokens, err := svc.RegisterWithPassword(context.Background(), "user@example.com", "password123", "Test User")
	if err != nil {
		t.Fatalf("register: %v", err)
	}

	verifier, err := NewVerifier("", secret)
	if err != nil {
		t.Fatalf("create verifier: %v", err)
	}
	defer verifier.Close()

	// Refresh tokens carry type=refresh and must not authenticate API calls.
	if _, err := verifier.Verify(tokens.RefreshToken); err == nil {
		t.Fatal("expected refresh token to be rejected as access token")
	}

	// Token signed with a different secret must fail.
	other := NewService(repo, "different-secret")
	otherUser, otherTokens, err := other.RegisterWithPassword(context.Background(), "other@example.com", "password123", "Other")
	if err != nil {
		t.Fatalf("register other: %v", err)
	}
	_ = otherUser
	if _, err := verifier.Verify(otherTokens.AccessToken); err == nil {
		t.Fatal("expected token signed with a different secret to be rejected")
	}
}