import { describe, it, expect, beforeEach } from "vitest";
import { expectedToken, safeEqual } from "./auth";

beforeEach(() => {
  process.env.LYRA_SECRET_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=";
  delete process.env.LYRA_PASSWORD;
});

describe("auth token", () => {
  it("returns '' when no password is configured (auth disabled)", async () => {
    expect(await expectedToken()).toBe("");
  });

  it("derives a stable, non-empty token from the password", async () => {
    process.env.LYRA_PASSWORD = "hunter2";
    const a = await expectedToken();
    const b = await expectedToken();
    expect(a).not.toBe("");
    expect(a).toBe(b); // deterministic
  });

  it("changes with the password and with the secret key", async () => {
    process.env.LYRA_PASSWORD = "hunter2";
    const base = await expectedToken();
    process.env.LYRA_PASSWORD = "different";
    expect(await expectedToken()).not.toBe(base);
    process.env.LYRA_PASSWORD = "hunter2";
    process.env.LYRA_SECRET_KEY = "ZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmY=";
    expect(await expectedToken()).not.toBe(base);
  });
});

describe("safeEqual", () => {
  it("matches equal strings and rejects others", () => {
    expect(safeEqual("abc", "abc")).toBe(true);
    expect(safeEqual("abc", "abd")).toBe(false);
    expect(safeEqual("abc", "ab")).toBe(false);
    expect(safeEqual("", "")).toBe(true);
  });
});