package captcha

import "testing"

func TestChallengeTokenRoundTrip(t *testing.T) {
	secret := []byte("s3cr3t")
	tok := makeChallengeToken(secret, "abc123", nowMs()+60_000, 50, 32, 4)
	claims := verifyChallengeToken(secret, tok)
	if claims == nil {
		t.Fatal("valid token rejected")
	}
	if claims.Nonce != "abc123" || claims.C != 50 || claims.S != 32 || claims.D != 4 {
		t.Fatalf("bad claims: %+v", claims)
	}
}

func TestChallengeTokenTamperAndExpiry(t *testing.T) {
	secret := []byte("s3cr3t")
	tok := makeChallengeToken(secret, "abc123", nowMs()+60_000, 50, 32, 4)
	if verifyChallengeToken([]byte("wrong"), tok) != nil {
		t.Error("token accepted under wrong secret")
	}
	if verifyChallengeToken(secret, tok+"x") != nil {
		t.Error("tampered token accepted")
	}
	expired := makeChallengeToken(secret, "abc123", nowMs()-1, 50, 32, 4)
	if verifyChallengeToken(secret, expired) != nil {
		t.Error("expired token accepted")
	}
}

func TestVerificationToken(t *testing.T) {
	secret := []byte("s3cr3t")
	vt, err := makeVerificationToken(secret, nowMs()+60_000)
	if err != nil {
		t.Fatal(err)
	}
	if !verifyVerificationToken(secret, vt) {
		t.Error("valid verification token rejected")
	}
	if verifyVerificationToken([]byte("wrong"), vt) {
		t.Error("verification token accepted under wrong secret")
	}
	expired, _ := makeVerificationToken(secret, nowMs()-1)
	if verifyVerificationToken(secret, expired) {
		t.Error("expired verification token accepted")
	}
}