import { expect, test } from "@playwright/test";
import {
  generateAccessKey,
  getAccessKeyPrefix,
  hashAccessKey,
  parseBearerAccessKey,
} from "@/lib/access-keys/token";
import {
  parseProvisioningBearerSecret,
  verifyProvisioningSecret,
} from "@/lib/access-keys/provisioning-secret";

test.describe("OpenAPI Access Key token helpers", () => {
  test("generates a parseable token without exposing its secret in the prefix", () => {
    const generated = generateAccessKey();

    expect(generated.token).toMatch(
      /^ydr_live_[a-f0-9]{12}_[A-Za-z0-9_-]{40,}$/
    );
    expect(getAccessKeyPrefix(generated.token)).toBe(generated.tokenPrefix);
    expect(generated.tokenPrefix).not.toContain(generated.token.split("_").at(-1));
  });

  test("parses only valid Bearer Access Keys", () => {
    const { token } = generateAccessKey();

    expect(parseBearerAccessKey(`Bearer ${token}`)).toBe(token);
    expect(parseBearerAccessKey(`bearer ${token}`)).toBe(token);
    expect(parseBearerAccessKey(token)).toBeNull();
    expect(parseBearerAccessKey("Bearer invalid")).toBeNull();
  });

  test("hashes deterministically with a server-side pepper", () => {
    const { token } = generateAccessKey();

    expect(hashAccessKey(token, "pepper-a")).toBe(
      hashAccessKey(token, "pepper-a")
    );
    expect(hashAccessKey(token, "pepper-a")).not.toBe(
      hashAccessKey(token, "pepper-b")
    );
  });
});

test.describe("third-party provisioning secret helpers", () => {
  const secret = "provisioning-secret-that-is-at-least-32-characters";

  test("parses a strict Bearer credential", () => {
    expect(parseProvisioningBearerSecret(`Bearer ${secret}`)).toBe(secret);
    expect(parseProvisioningBearerSecret(`bearer ${secret}`)).toBe(secret);
    expect(parseProvisioningBearerSecret(secret)).toBeNull();
    expect(parseProvisioningBearerSecret("Bearer two values")).toBeNull();
  });

  test("compares provisioning secrets and rejects short configuration", () => {
    expect(verifyProvisioningSecret(secret, secret)).toBe(true);
    expect(verifyProvisioningSecret(`${secret}-wrong`, secret)).toBe(false);
    expect(verifyProvisioningSecret("short", "short")).toBe(false);
  });
});