import { describe, it, expect } from 'vitest';
import {
  createFormToken,
  verifyFormToken,
  MAX_FORM_AGE_MS,
} from '@/lib/antispam/form-token';

const SECRET = 'test-secret';
const NOW = 1_000_000_000_000;

describe('signed form token', () => {
  it('issues a token that verifies with its issuance timestamp', () => {
    const token = createFormToken(NOW, SECRET);
    const result = verifyFormToken(token, NOW + 10_000, SECRET);
    expect(result.ok).toBe(true);
    expect(result.issuedAt).toBe(NOW);
  });

  it('rejects a token that was tampered with', () => {
    const token = createFormToken(NOW, SECRET);
    const [issuedAt, signature] = token.split('.');
    const tampered = `${issuedAt}.${signature.slice(0, -2)}xx`;
    const result = verifyFormToken(tampered, NOW + 10_000, SECRET);
    expect(result.ok).toBe(false);
  });

  it('rejects a token forged with a different secret', () => {
    const token = createFormToken(NOW, 'attacker-secret');
    const result = verifyFormToken(token, NOW + 10_000, SECRET);
    expect(result.ok).toBe(false);
  });

  it('rejects a token with a manipulated issuance timestamp', () => {
    const token = createFormToken(NOW, SECRET);
    const [, signature] = token.split('.');
    const forged = `${NOW - 60_000}.${signature}`;
    const result = verifyFormToken(forged, NOW, SECRET);
    expect(result.ok).toBe(false);
  });

  it('rejects malformed tokens', () => {
    expect(verifyFormToken('', NOW, SECRET).ok).toBe(false);
    expect(verifyFormToken('garbage', NOW, SECRET).ok).toBe(false);
    expect(verifyFormToken('123.456.789', NOW, SECRET).ok).toBe(false);
  });

  it('rejects tokens older than the maximum form age', () => {
    const token = createFormToken(NOW, SECRET);
    const result = verifyFormToken(token, NOW + MAX_FORM_AGE_MS + 1, SECRET);
    expect(result.ok).toBe(false);
    expect(result.reason).toBe('expired');
  });
});