import { test } from 'node:test';
import assert from 'node:assert/strict';
import { createAuth, readCookie, cookieHeader, COOKIE_NAME } from '../server/auth.js';

test('ohne Passwort ist der Schutz aus', () => {
  const a = createAuth({ password: '', secret: 's' });
  assert.equal(a.enabled, false);
  assert.equal(a.checkPassword(''), false);
});

test('Passwortprüfung und signierte Token', () => {
  let t = 1_000_000;
  const a = createAuth({ password: 'geheim', secret: 'schluessel', now: () => t });
  assert.ok(a.enabled);
  assert.ok(a.checkPassword('geheim'));
  assert.ok(!a.checkPassword('Geheim'));
  assert.ok(!a.checkPassword(undefined));
  const token = a.issue();
  assert.ok(a.verify(token));
  assert.ok(!a.verify(token + 'x'), 'manipulierte Signatur');
  assert.ok(!a.verify('123.abc'));
  assert.ok(!a.verify(''));
  const other = createAuth({ password: 'geheim', secret: 'anderer', now: () => t });
  assert.ok(!other.verify(token), 'anderer Schlüssel');
  t += a.ttlMs + 1;
  assert.ok(!a.verify(token), 'abgelaufen');
});

test('Bremse nach fünf Fehlversuchen', () => {
  let t = 0;
  const a = createAuth({ password: 'x', secret: 's', now: () => t });
  for (let i = 0; i < 4; i += 1) a.noteFailure('1.2.3.4');
  assert.equal(a.blockedFor('1.2.3.4'), 0);
  a.noteFailure('1.2.3.4');
  assert.ok(a.blockedFor('1.2.3.4') > 0);
  assert.equal(a.blockedFor('5.6.7.8'), 0);
  t += 61_000;
  assert.equal(a.blockedFor('1.2.3.4'), 0);
  a.noteFailure('1.2.3.4');
  a.noteSuccess('1.2.3.4');
  assert.equal(a.blockedFor('1.2.3.4'), 0);
});

test('Cookie lesen und schreiben', () => {
  const header = cookieHeader('abc.def', { secure: true });
  assert.ok(header.startsWith(`${COOKIE_NAME}=abc.def; Path=/; HttpOnly; SameSite=Lax; Max-Age=`));
  assert.ok(header.endsWith('; Secure'));
  assert.equal(readCookie(`foo=1; ${COOKIE_NAME}=abc.def; bar=2`), 'abc.def');
  assert.equal(readCookie('foo=1'), null);
  assert.equal(readCookie(undefined), null);
});