package auth

import (
	"errors"
	"testing"

	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
)

func newTestAPIKey() *APIKey {
	return NewAPIKey(config.AuthConfig{})
}

func TestAPIKey_GenerateVerify(t *testing.T) {
	t.Parallel()
	k := newTestAPIKey()
	key, err := k.Generate(RoleAdmin)
	if err != nil {
		t.Fatalf("Generate error: %v", err)
	}
	if key == "" {
		t.Fatal("Generate returned empty key")
	}
	if !k.Verify(key) {
		t.Errorf("Verify(%q) = false, want true", key)
	}
	role, ok := k.Lookup(key)
	if !ok || role != RoleAdmin {
		t.Errorf("Lookup(%q) = (%q,%v), want (admin,true)", key, role, ok)
	}
}

func TestAPIKey_GenerateUnique(t *testing.T) {
	t.Parallel()
	k := newTestAPIKey()
	a, err := k.Generate(RoleViewer)
	if err != nil {
		t.Fatalf("Generate error: %v", err)
	}
	b, err := k.Generate(RoleViewer)
	if err != nil {
		t.Fatalf("Generate error: %v", err)
	}
	if a == b {
		t.Fatal("two keys are identical, random generation ineffective")
	}
}

func TestAPIKey_GenerateInvalidRole(t *testing.T) {
	t.Parallel()
	k := newTestAPIKey()
	if _, err := k.Generate(Role("god")); !errors.Is(err, ErrInvalidRole) {
		t.Fatalf("Generate invalid role err = %v, want ErrInvalidRole", err)
	}
}

func TestAPIKey_VerifyUnknown(t *testing.T) {
	t.Parallel()
	k := newTestAPIKey()
	if k.Verify("not-a-key") {
		t.Error("Verify('not-a-key') = true, want false")
	}
	if k.Verify("") {
		t.Error("Verify('') = true, want false")
	}
}

func TestAPIKey_Revoke(t *testing.T) {
	t.Parallel()
	k := newTestAPIKey()
	key, err := k.Generate(RoleViewer)
	if err != nil {
		t.Fatalf("Generate error: %v", err)
	}
	if !k.Verify(key) {
		t.Fatalf("Verify before revoke = false, want true")
	}
	k.Revoke(key)
	if k.Verify(key) {
		t.Error("Verify after revoke = true, want false")
	}
}