import { describe, it, expect } from 'vitest';
import { mintToken, parseToken, sha256Hex } from './tokens';

describe('token format', () => {
  it('mints a fg_ token that parses back to a secret whose hash matches', () => {
    const t = mintToken();
    expect(t.raw.startsWith('fg_')).toBe(true);
    const parsed = parseToken(t.raw);
    expect(parsed).not.toBeNull();
    expect(parsed!.tokenId).toBe(t.tokenId);
    expect(sha256Hex(parsed!.secret)).toBe(t.tokenHash);
  });

  it('rejects malformed tokens', () => {
    expect(parseToken('nope')).toBeNull();
    expect(parseToken('fg_short')).toBeNull();
    expect(parseToken('')).toBeNull();
  });

  it('parses ids/secrets that contain underscores (base64url)', () => {
    // Fixed-offset parsing must not split on the first underscore.
    const t = mintToken();
    const parsed = parseToken(t.raw)!;
    expect(`fg_${parsed.tokenId}_${parsed.secret}`).toBe(t.raw);
  });
});