import { expect, test } from "bun:test";
import { sign, who, whoAtTty } from "./who.ts";

const KEY = "a-key-only-the-forge-holds";
const later = Date.now() + 60_000;
const request = (identity: string, signature: string): Request =>
  new Request("http://app/", {
    headers: { "x-forge-identity": identity, "x-forge-signature": signature },
  });

test("a signed identity is who it says", () => {
  const identity = `u1|alice|admin|${later}`;
  expect(who(request(identity, sign(identity, KEY)), KEY)).toEqual({
    role: "admin",
    id: "u1",
    name: "alice",
  });
});

test("a forged, tampered, expired or unsigned identity is anonymous", () => {
  const identity = `u1|alice|admin|${later}`;
  expect(who(request(identity, sign(identity, "another key")), KEY)).toEqual({
    role: "anon",
  });
  expect(
    who(request(`u1|alice|admin|${later + 1}`, sign(identity, KEY)), KEY),
  ).toEqual({ role: "anon" });
  const expired = `u1|alice|user|${Date.now() - 1}`;
  expect(who(request(expired, sign(expired, KEY)), KEY)).toEqual({
    role: "anon",
  });
  const odd = `u1|alice|owner|${later}`;
  expect(who(request(odd, sign(odd, KEY)), KEY)).toEqual({ role: "anon" });
  expect(who(new Request("http://app/"), KEY)).toEqual({ role: "anon" });
  // No key configured: nothing verifies, whoever signed it.
  expect(who(request(identity, sign(identity, KEY)), "")).toEqual({
    role: "anon",
  });
});

test("the terminal trusts its environment", () => {
  expect(whoAtTty({})).toEqual({ role: "anon" });
  expect(whoAtTty({ FORGE_APP_USER: "alice" })).toEqual({
    role: "user",
    id: "alice",
    name: "alice",
  });
  expect(
    whoAtTty({
      FORGE_APP_USER: "alice",
      FORGE_APP_USER_ID: "u1",
      FORGE_APP_USER_ROLE: "admin",
    }),
  ).toEqual({
    role: "admin",
    id: "u1",
    name: "alice",
  });
});