package security

import (
	"testing"
	"time"
)

func TestTOTPCodeVerifies(t *testing.T) {
	secret := "JBSWY3DPEHPK3PXP"
	now := time.Unix(1_800_000_000, 0)
	code := TOTPCode(secret, now.Unix()/totpPeriod)
	if !VerifyTOTP(secret, code, now) {
		t.Fatal("expected generated TOTP code to verify")
	}
}

func TestSecretBoxRoundTrip(t *testing.T) {
	box, err := NewSecretBox("test-secret-with-at-least-thirty-two-characters")
	if err != nil {
		t.Fatalf("NewSecretBox: %v", err)
	}
	ciphertext, err := box.Encrypt("super-secret")
	if err != nil {
		t.Fatalf("Encrypt: %v", err)
	}
	plaintext, err := box.Decrypt(ciphertext)
	if err != nil {
		t.Fatalf("Decrypt: %v", err)
	}
	if plaintext != "super-secret" {
		t.Fatalf("plaintext = %q", plaintext)
	}
}

func TestScopesForRole(t *testing.T) {
	if HasScope(ScopesForRole("admin"), ScopeAdminWrite) {
		t.Fatal("admin base role should require an explicit admin write assignment")
	}
	if !HasScope(AllAdminScopes(), ScopeAdminWrite) {
		t.Fatal("all admin scopes should include admin write scope")
	}
	if HasScope(ScopesForRole("customer"), ScopeAdminRead) {
		t.Fatal("customer should not have admin read scope")
	}
}