using ItWorx.KnowledgeHub.Infrastructure.Automation;

namespace ItWorx.KnowledgeHub.IntegrationTests.Automation;

/// <summary>
/// Pure, deterministic parsing tests for <see cref="ServiceAccountTokenIssuer"/> — no
/// database or container required. Regression coverage for a real defect: the
/// base64url alphabet used for the public ID can itself contain '_', the same
/// character used to delimit it from the secret. A naive `Split('_', 3)` mis-parsed
/// roughly 1 in 6 randomly generated tokens; this was found via a flaky integration
/// test (<see cref="ServiceAccountTests"/>) failing its very first bearer-authenticated
/// call, not by inspection. See ADR-015.
/// </summary>
public sealed class ServiceAccountTokenIssuerTests
{
    private readonly ServiceAccountTokenIssuer _issuer = new();

    [Fact]
    public void Round_trips_a_freshly_issued_token()
    {
        var issued = _issuer.IssueNewToken();

        var parsed = _issuer.TryParse(issued.RawToken, out var publicId, out var secret);

        Assert.True(parsed);
        Assert.Equal(issued.PublicId, publicId);
        Assert.Equal(_issuer.HashSecret(secret), issued.SecretHash);
    }

    [Fact]
    public void A_public_id_that_itself_contains_an_underscore_is_still_parsed_correctly()
    {
        // A synthetic token shaped exactly like a real one, deliberately constructed so
        // the 12-character public ID contains '_' characters — the exact case that
        // broke a delimiter-scanning parser.
        const string publicIdWithUnderscores = "a_b_c_d_e_f_";
        const string secret = "the-real-secret-value";
        var rawToken = $"ikh_{publicIdWithUnderscores}_{secret}";

        var parsed = _issuer.TryParse(rawToken, out var publicId, out var parsedSecret);

        Assert.True(parsed);
        Assert.Equal(publicIdWithUnderscores, publicId);
        Assert.Equal(secret, parsedSecret);
    }

    [Theory]
    [InlineData("")]
    [InlineData("not-a-token")]
    [InlineData("ikh_")]
    [InlineData("ikh_short")]
    [InlineData("ikh_123456789012")]
    [InlineData("ikh_123456789012_")]
    [InlineData("bearer_123456789012_secret")]
    public void Malformed_or_incomplete_tokens_are_rejected(string presented)
    {
        var parsed = _issuer.TryParse(presented, out _, out _);

        Assert.False(parsed);
    }
}