package authproxy

import (
	"encoding/base64"
	"strings"
	"testing"
)

func TestBoxRoundtrip(t *testing.T) {
	b, err := newBox(strings.Repeat("s", 32))
	if err != nil {
		t.Fatal(err)
	}
	in := stateClaims{Host: "app.example.com", RD: "/x?a=1&b=2", Proto: "https", Nonce: "n", Exp: 123}
	tok, err := b.seal("state", in)
	if err != nil {
		t.Fatal(err)
	}
	var out stateClaims
	if err := b.open("state", tok, &out); err != nil {
		t.Fatal(err)
	}
	if out != in {
		t.Fatalf("roundtrip mismatch: %+v != %+v", out, in)
	}
}

func TestBoxRejectsWrongPurpose(t *testing.T) {
	b, _ := newBox(strings.Repeat("s", 32))
	tok, _ := b.seal("state", stateClaims{Host: "a"})
	var out stateClaims
	if err := b.open("session", tok, &out); err == nil {
		t.Fatal("expected purpose mismatch to fail")
	}
}

func TestBoxRejectsTampering(t *testing.T) {
	b, _ := newBox(strings.Repeat("s", 32))
	tok, _ := b.seal("state", stateClaims{Host: "a"})
	raw, _ := base64.RawURLEncoding.DecodeString(tok)
	raw[len(raw)-1] ^= 0x01
	tampered := base64.RawURLEncoding.EncodeToString(raw)
	var out stateClaims
	if err := b.open("state", tampered, &out); err == nil {
		t.Fatal("expected tampered token to fail")
	}
}

func TestBoxRejectsWrongKey(t *testing.T) {
	b1, _ := newBox(strings.Repeat("a", 32))
	b2, _ := newBox(strings.Repeat("b", 32))
	tok, _ := b1.seal("state", stateClaims{Host: "a"})
	var out stateClaims
	if err := b2.open("state", tok, &out); err == nil {
		t.Fatal("expected wrong key to fail")
	}
}