import { afterEach, beforeEach, describe, expect, it } from "vitest";

import { buildAdminSessionToken, verifyAdminSessionToken } from "@/lib/admin-session-token";

const originalSecret = process.env.ADMIN_AUTH_SECRET;

beforeEach(() => {
  process.env.ADMIN_AUTH_SECRET = "unit-test-secret";
});

afterEach(() => {
  process.env.ADMIN_AUTH_SECRET = originalSecret;
});

describe("admin session token", () => {
  it("round-trips a signed token", () => {
    expect(verifyAdminSessionToken(buildAdminSessionToken())).toBe(true);
  });

  it("rejects forged, malformed, or missing tokens", () => {
    expect(verifyAdminSessionToken("superadmin")).toBe(false);
    expect(verifyAdminSessionToken("superadmin.deadbeef")).toBe(false);
    expect(verifyAdminSessionToken("other." + buildAdminSessionToken().split(".")[1])).toBe(false);
    expect(verifyAdminSessionToken("")).toBe(false);
    expect(verifyAdminSessionToken(undefined)).toBe(false);
    expect(verifyAdminSessionToken("1")).toBe(false);
  });

  it("rejects a token signed with a different secret", () => {
    const token = buildAdminSessionToken();
    process.env.ADMIN_AUTH_SECRET = "rotated";
    expect(verifyAdminSessionToken(token)).toBe(false);
  });

  it("never validates when no secret is configured", () => {
    process.env.ADMIN_AUTH_SECRET = "";
    expect(verifyAdminSessionToken("superadmin.anything")).toBe(false);
  });
});