const { test } = require("node:test");
const assert = require("node:assert");
const { createState, verifyState } = require("../src/lib/oauthState");

const SECRET = "test-secret";

test("createState then verifyState round-trips key and account", () => {
  const now = () => new Date("2026-08-24T00:00:00.000Z").getTime();
  const state = createState({ key: "lineworks-form-sync", account: "svc@example.co.jp", secret: SECRET, now });
  const data = verifyState({ state, secret: SECRET, now });
  assert.deepStrictEqual(data, { key: "lineworks-form-sync", account: "svc@example.co.jp" });
});

test("verifyState returns null when the signature does not match (tampered state)", () => {
  const state = createState({ key: "lineworks-form-sync", account: "svc@example.co.jp", secret: SECRET });
  const tampered = state.slice(0, -1) + (state.at(-1) === "0" ? "1" : "0");
  assert.strictEqual(verifyState({ state: tampered, secret: SECRET }), null);
});

test("verifyState returns null when the state is older than maxAgeMs", () => {
  const issuedAt = () => new Date("2026-08-24T00:00:00.000Z").getTime();
  const state = createState({ key: "lineworks-form-sync", account: "svc@example.co.jp", secret: SECRET, now: issuedAt });
  const later = () => issuedAt() + 11 * 60 * 1000;
  assert.strictEqual(verifyState({ state, secret: SECRET, maxAgeMs: 10 * 60 * 1000, now: later }), null);
});