package logic

import (
	"testing"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

func TestAdminJWTRoundTrip(t *testing.T) {
	s := NewTokenService("wyrs-admin-jwt-secret-change-in-production-2025")
	tok, err := s.CreateToken(42, "ops", "SUPER_ADMIN", "users,groups,imMessages")
	if err != nil {
		t.Fatal(err)
	}
	claims, err := s.Parse(tok)
	if err != nil {
		t.Fatal(err)
	}
	if claims.AdminID != 42 || claims.Type != TypeAdmin || claims.Subject != "ops" {
		t.Fatalf("%+v", claims)
	}
}

func TestAdminJWTAcceptsHS512(t *testing.T) {
	secret := "wyrs-admin-jwt-secret-change-in-production-2025"
	s := NewTokenService(secret)
	now := time.Now()
	claims := Claims{
		AdminID:     1,
		Role:        "SUPER_ADMIN",
		Type:        TypeAdmin,
		Permissions: "*",
		RegisteredClaims: jwt.RegisteredClaims{
			Subject:   "admin",
			IssuedAt:  jwt.NewNumericDate(now),
			ExpiresAt: jwt.NewNumericDate(now.Add(time.Hour)),
		},
	}
	tok := jwt.NewWithClaims(jwt.SigningMethodHS512, &claims)
	signed, err := tok.SignedString([]byte(secret))
	if err != nil {
		t.Fatal(err)
	}
	got, err := s.Parse(signed)
	if err != nil {
		t.Fatal(err)
	}
	if got.AdminID != 1 || got.Subject != "admin" {
		t.Fatalf("%+v", got)
	}
}

func TestAdminJWTRejectsWrongType(t *testing.T) {
	s := NewTokenService("wyrs-admin-jwt-secret-change-in-production-2025")
	tok, err := s.CreateToken(1, "x", "SUPER_ADMIN", "")
	if err != nil {
		t.Fatal(err)
	}
	// tamper by parsing with different secret
	bad := NewTokenService("other-secret-other-secret-other!!")
	if _, err := bad.Parse(tok); err == nil {
		t.Fatal("expected invalid")
	}
}

func TestAdminJWTShortSecretAndNil(t *testing.T) {
	s := NewTokenService("short")
	tok, err := s.CreateToken(1, "ops", "SUPER_ADMIN", "")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.Parse(tok); err != nil {
		t.Fatal(err)
	}
	if _, err := (*TokenService)(nil).Parse("x"); err == nil {
		t.Fatal("nil parse")
	}
	if _, err := s.Parse(""); err == nil {
		t.Fatal("empty")
	}
}