import { test, before } from 'node:test'
import assert from 'node:assert/strict'
import { createHmac } from 'node:crypto'

let createPushTimeToken
let verifyPushTimeToken

before(async () => {
  process.env.PUSH_TIME_SECRET = 'x'.repeat(40)
  // config.js liest die Umgebung beim Import
  ;({ createPushTimeToken, verifyPushTimeToken } = await import('../server/services/pushTimeToken.js'))
})

const DAY = 86400 * 1000
const b64 = (value) => Buffer.from(value).toString('base64url')

test('Token rundet sauber', () => {
  const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' })
  assert.deepEqual(verifyPushTimeToken(token), { worksheetId: 'ws1', employeeId: 'e1' })
})

test('nach 14 Tagen abgelaufen', () => {
  const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' }, 0)
  assert.deepEqual(verifyPushTimeToken(token, 14 * DAY + 1000), { error: 'expired' })
  assert.deepEqual(verifyPushTimeToken(token, 14 * DAY - 1000), { worksheetId: 'ws1', employeeId: 'e1' })
})

test('manipulierte Nutzlast oder Signatur', () => {
  const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' })
  const [payload, sig] = token.split('.')
  const data = JSON.parse(Buffer.from(payload, 'base64url').toString())
  const forged = `${b64(JSON.stringify({ ...data, w: 'ws2' }))}.${sig}`
  assert.deepEqual(verifyPushTimeToken(forged), { error: 'invalid' })
  const lastChar = sig.at(-1) === 'A' ? 'B' : 'A'
  assert.deepEqual(verifyPushTimeToken(`${payload}.${sig.slice(0, -1)}${lastChar}`), { error: 'invalid' })
  for (const bad of ['', 'abc', 'a.b.c', undefined, null]) {
    assert.deepEqual(verifyPushTimeToken(bad), { error: 'invalid' })
  }
})

test('anderes Secret', () => {
  const payload = b64(JSON.stringify({ w: 'ws1', e: 'e1', x: Math.floor(Date.now() / 1000) + 3600 }))
  const sig = createHmac('sha256', 'y'.repeat(40)).update(payload).digest('base64url')
  assert.deepEqual(verifyPushTimeToken(`${payload}.${sig}`), { error: 'invalid' })
})