import { describe, it, expect, beforeAll } from "vitest";
import {
  createAdminSession,
  verifyAdminSession,
  COOKIE_NAME_ADMIN,
  cookieOptions,
} from "../admin-session";

const SECRET = "a".repeat(64);

beforeAll(() => {
  process.env.ADMIN_SESSION_SECRET = SECRET;
  process.env.NEXT_PUBLIC_APP_URL = "https://testbed.mk";
});

describe("admin-session.sign/verify", () => {
  it("round-trips a valid session", async () => {
    const token = await createAdminSession({ username: "alice", role: "ADMIN" });
    const parsed = await verifyAdminSession(token);
    expect(parsed).toEqual({ username: "alice", role: "ADMIN" });
  });

  it("round-trips SUPER_ADMIN role", async () => {
    const token = await createAdminSession({ username: "super", role: "SUPER_ADMIN" });
    const parsed = await verifyAdminSession(token);
    expect(parsed).toEqual({ username: "super", role: "SUPER_ADMIN" });
  });

  it("rejects a tampered payload (signature no longer matches)", async () => {
    const token = await createAdminSession({ username: "alice", role: "ADMIN" });
    const [payload, sig] = token.split(".");
    const tamperedPayload = btoa(
      JSON.stringify({ username: "alice", role: "SUPER_ADMIN" })
    );
    const tampered = `${tamperedPayload}.${sig}`;
    const parsed = await verifyAdminSession(tampered);
    expect(parsed).toBeNull();
    expect(payload).not.toEqual(tamperedPayload);
  });

  it("rejects a tampered signature", async () => {
    const token = await createAdminSession({ username: "alice", role: "ADMIN" });
    const [payload] = token.split(".");
    const forgedSig = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
    const forged = `${payload}.${forgedSig}`;
    const parsed = await verifyAdminSession(forged);
    expect(parsed).toBeNull();
  });

  it("rejects a malformed token without separator", async () => {
    const parsed = await verifyAdminSession("just-a-string-no-separator");
    expect(parsed).toBeNull();
  });

  it("rejects a token whose payload is not valid base64 JSON", async () => {
    const fakePayload = btoa("not-json-at-all");
    const fakeToken = `${fakePayload}.aaaaaaaa`;
    const parsed = await verifyAdminSession(fakeToken);
    expect(parsed).toBeNull();
  });
});

describe("admin-session.cookieOptions", () => {
  it("emits the documented cookie name and secure flags", () => {
    const opts = cookieOptions("token-value");
    expect(opts.name).toBe(COOKIE_NAME_ADMIN);
    expect(opts.value).toBe("token-value");
    expect(opts.httpOnly).toBe(true);
    expect(opts.sameSite).toBe("lax");
    expect(opts.path).toBe("/");
  });

  it("marks the cookie secure only in production", () => {
    const prev = process.env.NODE_ENV;
    process.env.NODE_ENV = "production";
    expect(cookieOptions("x").secure).toBe(true);
    process.env.NODE_ENV = "test";
    expect(cookieOptions("x").secure).toBe(false);
    process.env.NODE_ENV = prev;
  });
});