package auth

import (
	"testing"
	"time"
)

func TestSessionsAndRotation(t *testing.T) {
	s := New("1234", "9876", string(make([]byte, 32)), time.Hour, false)
	c, err := s.Authenticate(Student, "1234", "ip")
	if err != nil {
		t.Fatal(err)
	}
	if c.SessionID == "" || c.CSRFToken == "" {
		t.Fatal("missing random claims")
	}
	raw := s.Sign(c)
	got, err := s.Parse(raw)
	if err != nil || got.Role != Student {
		t.Fatalf("parse: %#v %v", got, err)
	}
	rotated := New("4321", "9876", string(make([]byte, 32)), time.Hour, false)
	if _, err := rotated.Parse(raw); err == nil {
		t.Fatal("PIN rotation did not invalidate session")
	}
}
func TestWrongPINAndExpiry(t *testing.T) {
	s := New("1234", "9876", string(make([]byte, 32)), time.Hour, false)
	if _, err := s.Authenticate(Instructor, "bad", "ip"); err == nil {
		t.Fatal("wrong PIN accepted")
	}
	c, _ := s.Authenticate(Student, "1234", "another")
	c.ExpiresAt = time.Now().Add(-time.Second).Unix()
	if _, err := s.Parse(s.Sign(c)); err == nil {
		t.Fatal("expired session accepted")
	}
}