Initial import of Forge app

server/tokens.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest';
+import { mintToken, parseToken, sha256Hex } from './tokens';
+
+describe('token format', () => {
+  it('mints a fg_ token that parses back to a secret whose hash matches', () => {
+    const t = mintToken();
+    expect(t.raw.startsWith('fg_')).toBe(true);
+    const parsed = parseToken(t.raw);
+    expect(parsed).not.toBeNull();
+    expect(parsed!.tokenId).toBe(t.tokenId);
+    expect(sha256Hex(parsed!.secret)).toBe(t.tokenHash);
+  });
+
+  it('rejects malformed tokens', () => {
+    expect(parseToken('nope')).toBeNull();
+    expect(parseToken('fg_short')).toBeNull();
+    expect(parseToken('')).toBeNull();
+  });
+
+  it('parses ids/secrets that contain underscores (base64url)', () => {
+    // Fixed-offset parsing must not split on the first underscore.
+    const t = mintToken();
+    const parsed = parseToken(t.raw)!;
+    expect(`fg_${parsed.tokenId}_${parsed.secret}`).toBe(t.raw);
+  });
+});