/** JWT 签发/校验单元测试（@devos/auth） */
import { describe, test, expect } from "bun:test";
import { signJwt, verifyJwt, hashPassword, verifyPassword } from "../packages/auth/src/index";

const SECRET = "test-secret";

describe("JWT", () => {
  test("签发并校验合法令牌", () => {
    const token = signJwt({ sub: "u1", email: "a@b.c", wid: "w1" }, SECRET, { nowSec: 1000, expiresInSec: 3600 });
    const result = verifyJwt(token, SECRET, 2000);
    expect(result.ok).toBe(true);
    if (result.ok) {
      expect(result.payload.sub).toBe("u1");
      expect(result.payload.wid).toBe("w1");
      expect(result.payload.exp).toBe(4600);
    }
  });

  test("过期令牌被拒绝", () => {
    const token = signJwt({ sub: "u1", email: "a@b.c", wid: null }, SECRET, { nowSec: 1000, expiresInSec: 100 });
    const result = verifyJwt(token, SECRET, 2000);
    expect(result.ok).toBe(false);
    if (!result.ok) expect(result.reason).toBe("EXPIRED");
  });

  test("篡改签名被拒绝", () => {
    const token = signJwt({ sub: "u1", email: "a@b.c", wid: null }, SECRET);
    const parts = token.split(".");
    const tampered = `${parts[0]}.${parts[1]}.AAAA${parts[2].slice(4)}`;
    expect(verifyJwt(tampered, SECRET).ok).toBe(false);
  });

  test("错误密钥被拒绝", () => {
    const token = signJwt({ sub: "u1", email: "a@b.c", wid: null }, SECRET);
    expect(verifyJwt(token, "other-secret").ok).toBe(false);
  });

  test("alg 混淆攻击被拒绝（仅接受 HS256）", () => {
    const forgedHeader = Buffer.from(JSON.stringify({ alg: "none" })).toString("base64url");
    const payload = Buffer.from(JSON.stringify({ sub: "u1", exp: 9999999999 })).toString("base64url");
    const forged = `${forgedHeader}.${payload}.`;
    expect(verifyJwt(forged, SECRET).ok).toBe(false);
  });

  test("畸形令牌被拒绝", () => {
    expect(verifyJwt("abc", SECRET).ok).toBe(false);
    expect(verifyJwt("a.b.c", SECRET).ok).toBe(false);
  });
});

describe("Password", () => {
  test("哈希并校验密码", async () => {
    const hash = await hashPassword("MyPassword123!");
    expect(hash).not.toContain("MyPassword123!");
    expect(await verifyPassword("MyPassword123!", hash)).toBe(true);
    expect(await verifyPassword("wrong", hash)).toBe(false);
  });
});