describe('module-pull-token', () => {
  beforeEach(() => {
    jest.resetModules();
    jest.useFakeTimers();
    jest.setSystemTime(new Date('2026-06-02T00:00:00.000Z'));
    process.env.MODULE_PULL_TOKEN_SECRET = 'm'.repeat(32);
  });

  afterEach(() => {
    jest.useRealTimers();
    delete process.env.MODULE_PULL_TOKEN_SECRET;
  });

  it('应生成 15 分钟有效且绑定模块仓库的短期拉包凭证', async () => {
    const { createModulePullCredential, verifyModulePullToken } = await import('../module-pull-token');

    const { credential, payload } = createModulePullCredential({
      projectCode: 'flnxi',
      licenseId: 'license-1',
      activationId: 'activation-1',
      instanceId: 'instance-1',
      moduleId: 'intranet-penetration-core',
      registryHost: 'registry.test',
      repository: 'flnxi/premium/intranet-penetration-core',
      tag: '1.0.0',
      digest: 'sha256:abc',
    });

    expect(credential.username).toBe('flnxi-module');
    expect(credential.expiresAt).toBe('2026-06-02T00:15:00.000Z');
    expect(payload.repository).toBe('flnxi/premium/intranet-penetration-core');
    expect(verifyModulePullToken(credential.pullToken)).toEqual(
      expect.objectContaining({
        projectCode: 'flnxi',
        moduleId: 'intranet-penetration-core',
        repository: 'flnxi/premium/intranet-penetration-core',
        digest: 'sha256:abc',
      })
    );
  });

  it('篡改 token 内容后应拒绝验证', async () => {
    const { createModulePullCredential, verifyModulePullToken } = await import('../module-pull-token');
    const { credential } = createModulePullCredential({
      projectCode: 'flnxi',
      licenseId: 'license-1',
      activationId: 'activation-1',
      instanceId: 'instance-1',
      moduleId: 'intranet-penetration-core',
      registryHost: 'registry.test',
      repository: 'flnxi/premium/intranet-penetration-core',
      tag: '1.0.0',
      digest: null,
    });

    const [payload, signature] = credential.pullToken.split('.');
    const decoded = JSON.parse(Buffer.from(payload + '==', 'base64url').toString('utf8'));
    decoded.moduleId = 'custom-templates-core';
    const tamperedPayload = Buffer.from(JSON.stringify(decoded), 'utf8').toString('base64url');

    expect(verifyModulePullToken(`${tamperedPayload}.${signature}`)).toBeNull();
  });

  it('过期 token 应拒绝验证', async () => {
    const { createModulePullCredential, verifyModulePullToken } = await import('../module-pull-token');
    const { credential } = createModulePullCredential({
      projectCode: 'flnxi',
      licenseId: 'license-1',
      activationId: 'activation-1',
      instanceId: 'instance-1',
      moduleId: 'intranet-penetration-core',
      registryHost: 'registry.test',
      repository: 'flnxi/premium/intranet-penetration-core',
      tag: '1.0.0',
      digest: null,
    });

    expect(verifyModulePullToken(credential.pullToken, new Date('2026-06-02T00:15:01.000Z'))).toBeNull();
  });
});