import { describe, expect, test } from "bun:test";
import { csrfTokenFor, verifyCsrfToken } from "../../src/lib/csrf.ts";
import { ForbiddenError } from "../../src/lib/errors.ts";

describe("csrf", () => {
	test("token is deterministic per did", () => {
		expect(csrfTokenFor("did:plc:alice")).toBe(csrfTokenFor("did:plc:alice"));
	});

	test("different dids get different tokens", () => {
		expect(csrfTokenFor("did:plc:alice")).not.toBe(csrfTokenFor("did:plc:bob"));
	});

	test("verifyCsrfToken accepts a matching token", () => {
		const t = csrfTokenFor("did:plc:alice");
		expect(() => {
			verifyCsrfToken(t, "did:plc:alice");
		}).not.toThrow();
	});

	test("verifyCsrfToken rejects another user's token", () => {
		const bob = csrfTokenFor("did:plc:bob");
		expect(() => {
			verifyCsrfToken(bob, "did:plc:alice");
		}).toThrow(ForbiddenError);
	});

	test("verifyCsrfToken rejects null", () => {
		expect(() => {
			verifyCsrfToken(null, "did:plc:alice");
		}).toThrow(ForbiddenError);
	});

	test("verifyCsrfToken rejects garbage", () => {
		expect(() => {
			verifyCsrfToken("not-a-real-token", "did:plc:alice");
		}).toThrow(ForbiddenError);
	});
});