process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret'

const { test } = require('node:test')
const assert = require('node:assert/strict')
const crypto = require('crypto')

const ssoState = require('../src/auth/ssoState')

test('createTx → verifyTx round-trips the flow payload', () => {
  const tx = ssoState.createTx({ provider: 'google', mode: 'login', returnTo: '/admin/posts' })
  assert.ok(tx.nonce && tx.verifier && tx.codeChallenge && tx.txToken)

  const payload = ssoState.verifyTx(tx.txToken, tx.nonce)
  assert.ok(payload)
  assert.equal(payload.provider, 'google')
  assert.equal(payload.mode, 'login')
  assert.equal(payload.returnTo, '/admin/posts')
  assert.equal(payload.verifier, tx.verifier)
})

test('codeChallenge is the S256 hash of the verifier', () => {
  const tx = ssoState.createTx({ provider: 'discord', mode: 'login' })
  const expected = crypto.createHash('sha256').update(tx.verifier).digest('base64url')
  assert.equal(tx.codeChallenge, expected)
})

test('verifyTx rejects a mismatched / tampered nonce', () => {
  const tx = ssoState.createTx({ provider: 'google', mode: 'login' })
  assert.equal(ssoState.verifyTx(tx.txToken, 'wrong-nonce'), null)
  assert.equal(ssoState.verifyTx(tx.txToken, null), null)
  assert.equal(ssoState.verifyTx(null, tx.nonce), null)
})

test('verifyTx rejects a non-tx token', () => {
  const token = require('../src/auth/token')
  const notTx = token.signToken({ id: 1, username: 'a', role: 'admin' })
  assert.equal(ssoState.verifyTx(notTx, 'anything'), null)
})