package creator_auth_test

import (
	"encoding/json"
	"git.cin.su/m/Assistant/contracts/identity"
	"git.cin.su/m/Assistant/modules/identity/domain"
	"strings"
	"testing"
	"time"
)

func TestCreatorSessionIsTimeBoundAndDoesNotCarryAuthority(t *testing.T) {
	now := time.Unix(1000, 0)
	token, session, err := domain.IssueCreatorSession([]byte("01234567890123456789012345678901"), now, time.Minute)
	if err != nil || session.ExpiresAtUnix != 1060 {
		t.Fatal("issue failed")
	}
	if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token, now); err != nil {
		t.Fatal(err)
	}
	if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token, now.Add(time.Minute)); err == nil {
		t.Fatal("expired session accepted")
	}
	if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token+"tampered", now); err == nil {
		t.Fatal("tampered session accepted")
	}
	payload, err := json.Marshal(session)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(payload), "Grant") || strings.Contains(string(payload), "Scope") {
		t.Fatal("identity session must not carry authority")
	}
}

func TestCreatorUsernameAndPasswordMustBothMatch(t *testing.T) {
	if !domain.CreatorCredentialsMatch("m", "password", identity.CreatorCredentials{Username: "m", Password: "password"}) {
		t.Fatal("matching Creator credentials rejected")
	}
	for _, supplied := range []identity.CreatorCredentials{
		{},
		{Username: "m", Password: "wrong"},
		{Username: "wrong", Password: "password"},
		{Username: "m"},
		{Password: "password"},
	} {
		if domain.CreatorCredentialsMatch("m", "password", supplied) {
			t.Fatalf("invalid Creator credentials accepted: username=%q", supplied.Username)
		}
	}
}

func TestCreatorBootstrapCredentialMustMatch(t *testing.T) {
	if !domain.BootstrapMatches("expected", "expected") {
		t.Fatal("matching bootstrap credential rejected")
	}
	for _, supplied := range []string{"", "wrong"} {
		if domain.BootstrapMatches("expected", supplied) {
			t.Fatalf("invalid bootstrap credential %q accepted", supplied)
		}
	}
}