package jwt

import (
	"errors"
	"testing"
	"time"

	"gitlab.com/dynaweb/ains-microservices/pkg/config"
)

func testManager(accessTTL time.Duration) *Manager {
	cfg := &config.Config{}
	cfg.JWT.Secret = "test-secret"
	cfg.JWT.Issuer = "ains-test"
	cfg.JWT.AccessTTL = accessTTL
	cfg.JWT.RefreshTTL = time.Hour
	return NewManager(cfg)
}

func TestIssueAndParseAccess(t *testing.T) {
	m := testManager(time.Minute)
	id := Identity{UserID: 42, Role: "teacher", State: "Johor", PPD: "PPD JB", School: "S1"}

	token, err := m.IssueAccess(id)
	if err != nil {
		t.Fatal(err)
	}

	claims, err := m.ParseAccess(token)
	if err != nil {
		t.Fatal(err)
	}
	if claims.UserID != 42 || claims.Role != "teacher" || claims.School != "S1" {
		t.Fatalf("unexpected claims: %+v", claims)
	}
}

func TestParseAccessRejectsRefresh(t *testing.T) {
	m := testManager(time.Minute)
	token, err := m.IssueRefresh(Identity{UserID: 1, Role: "murid"})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := m.ParseAccess(token); !errors.Is(err, ErrWrongType) {
		t.Fatalf("expected ErrWrongType, got %v", err)
	}
}

func TestParseRejectsTampered(t *testing.T) {
	m := testManager(time.Minute)
	if _, err := m.ParseAccess("not.a.token"); !errors.Is(err, ErrInvalidToken) {
		t.Fatalf("expected ErrInvalidToken, got %v", err)
	}
}

func TestExpiredToken(t *testing.T) {
	m := testManager(-time.Minute)
	token, err := m.IssueAccess(Identity{UserID: 1, Role: "murid"})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := m.ParseAccess(token); !errors.Is(err, ErrExpiredToken) {
		t.Fatalf("expected ErrExpiredToken, got %v", err)
	}
}