package auth

import (
	"testing"
	"time"
)

func TestGenerateAndValidate(t *testing.T) {
	tm := NewTokenManager("a-very-long-secret-key-that-is-at-least-32-bytes!!", 720)

	token, err := tm.Generate("user-123", "testuser", "admin")
	if err != nil {
		t.Fatalf("Generate error: %v", err)
	}
	if token == "" {
		t.Fatal("token should not be empty")
	}

	claims, err := tm.Validate(token)
	if err != nil {
		t.Fatalf("Validate error: %v", err)
	}

	if claims.UserID != "user-123" {
		t.Errorf("expected UserID=user-123, got %s", claims.UserID)
	}
	if claims.Username != "testuser" {
		t.Errorf("expected Username=testuser, got %s", claims.Username)
	}
	if claims.Role != "admin" {
		t.Errorf("expected Role=admin, got %s", claims.Role)
	}
	if !claims.IsAdmin() {
		t.Error("expected IsAdmin()=true")
	}
}

func TestValidateInvalidToken(t *testing.T) {
	tm := NewTokenManager("the-real-secret-key-that-is-32-bytes!!", 720)

	_, err := tm.Validate("invalid.token.here")
	if err == nil {
		t.Error("expected error for invalid token")
	}
}

func TestValidateWrongSecret(t *testing.T) {
	tm1 := NewTokenManager("secret-key-number-one-that-is-32-bytes!", 720)
	tm2 := NewTokenManager("secret-key-number-two-that-is-32-bytes!", 720)

	token, _ := tm1.Generate("user-1", "test", "user")
	_, err := tm2.Validate(token)
	if err == nil {
		t.Error("expected error when validating with wrong secret")
	}
}

func TestExpiredToken(t *testing.T) {
	tm := NewTokenManager("a-very-long-secret-key-that-is-at-least-32-bytes!!", -1) // expired immediately

	token, err := tm.Generate("user-1", "test", "user")
	if err != nil {
		t.Fatalf("Generate error: %v", err)
	}

	_, err = tm.Validate(token)
	if err == nil {
		t.Error("expected error for expired token")
	}
}

func TestHashPassword(t *testing.T) {
	hash, err := HashPassword("my-secure-password")
	if err != nil {
		t.Fatalf("HashPassword error: %v", err)
	}
	if hash == "" {
		t.Fatal("hash should not be empty")
	}
	if hash == "my-secure-password" {
		t.Error("hash should not be the plaintext password")
	}
}

func TestCheckPassword(t *testing.T) {
	hash, _ := HashPassword("correct-password")

	if !CheckPassword("correct-password", hash) {
		t.Error("expected password to match")
	}
	if CheckPassword("wrong-password", hash) {
		t.Error("expected wrong password to not match")
	}
}

func TestClaimsIsAdmin(t *testing.T) {
	admin := &Claims{Role: "admin"}
	user := &Claims{Role: "user"}
	empty := &Claims{}

	if !admin.IsAdmin() {
		t.Error("admin claims should have IsAdmin()=true")
	}
	if user.IsAdmin() {
		t.Error("user claims should have IsAdmin()=false")
	}
	if empty.IsAdmin() {
		t.Error("empty claims should have IsAdmin()=false")
	}
}

func TestTokenManagerExpiry(t *testing.T) {
	tm := NewTokenManager("a-very-long-secret-key-that-is-at-least-32-bytes!!", 1) // 1 hour

	token, _ := tm.Generate("user-1", "test", "user")
	claims, err := tm.Validate(token)
	if err != nil {
		t.Fatalf("Validate error: %v", err)
	}

	issuedAt := claims.IssuedAt.Time
	expiresAt := claims.ExpiresAt.Time
	diff := expiresAt.Sub(issuedAt)

	if diff < 59*time.Minute || diff > 61*time.Minute {
		t.Errorf("expected expiry ~1 hour from issue, got %v", diff)
	}
}