package secrets

import (
	"encoding/base64"
	"testing"

	"github.com/stretchr/testify/require"
)

func TestNewTokenReturnsRawURLTokenWithRequestedEntropy(t *testing.T) {
	t.Parallel()

	token, err := NewToken(18)
	require.NoError(t, err)
	require.NotEmpty(t, token)

	decoded, err := base64.RawURLEncoding.DecodeString(token)
	require.NoError(t, err)
	require.Len(t, decoded, 18)
	require.NotContains(t, token, "=")
}

func TestNewTokenThirtyTwoBytesHasSessionLength(t *testing.T) {
	t.Parallel()

	token, err := NewToken(32)
	require.NoError(t, err)
	require.Len(t, token, 43)
	decoded, err := base64.RawURLEncoding.Strict().DecodeString(token)
	require.NoError(t, err)
	require.Len(t, decoded, 32)
	require.Equal(t, token, base64.RawURLEncoding.EncodeToString(decoded))
}

func TestNewTokenRejectsNonPositiveByteLength(t *testing.T) {
	t.Parallel()

	_, err := NewToken(0)
	require.ErrorContains(t, err, "byte length must be positive")
}

func TestHashTokenAndMatchesHash(t *testing.T) {
	t.Parallel()

	hash := HashToken("secret-token")
	require.Len(t, hash, 64)
	require.Equal(t, hash, HashToken("secret-token"))
	require.True(t, TokenMatchesHash("secret-token", hash))
	require.False(t, TokenMatchesHash("other-token", hash))
	require.False(t, TokenMatchesHash("secret-token", hash[:len(hash)-1]))
}