import { beforeEach, describe, expect, it, vi } from "vitest";
import { createOAuthState, verifyOAuthState } from "../oauth-state";

describe("oauth-state", () => {
  beforeEach(() => {
    process.env.AUTH_SECRET = "test-auth-secret-not-for-production";
  });

  it("verifies a state token for the staff member it was issued to", () => {
    const state = createOAuthState("staff-123");
    expect(verifyOAuthState(state, "staff-123")).toBe(true);
  });

  it("rejects a state token issued to a different staff member", () => {
    const state = createOAuthState("staff-123");
    expect(verifyOAuthState(state, "staff-999")).toBe(false);
  });

  it("rejects a tampered token", () => {
    const state = createOAuthState("staff-123");
    const tampered = `${state.slice(0, -2)}xx`;
    expect(verifyOAuthState(tampered, "staff-123")).toBe(false);
  });

  it("rejects a malformed token", () => {
    expect(verifyOAuthState("not-a-real-token", "staff-123")).toBe(false);
    expect(verifyOAuthState("", "staff-123")).toBe(false);
  });

  it("rejects an expired token", () => {
    vi.useFakeTimers();
    const state = createOAuthState("staff-123");
    vi.advanceTimersByTime(11 * 60 * 1000); // past the 10-minute max age
    expect(verifyOAuthState(state, "staff-123")).toBe(false);
    vi.useRealTimers();
  });
});