package store

import (
	"testing"
	"time"
)

func TestSessionSQLStoresDigestAndEnforcesRevocationBoundary(t *testing.T) {
	for query, fragments := range map[string][]string{
		// Issuance and authentication must both consult the identity's ban
		// state; these fragments are the durable enforcement points.
		SessionInsertSQL:             {"token_digest", "expires_at", "created_at", "banned_until", "FROM identities"},
		SessionSelectSQL:             {"token_digest", "revoked_at", "banned_until", "JOIN identities", "WHERE s.session_id = $1"},
		SessionRevokeSQL:             {"COALESCE(revoked_at", "WHERE session_id = $1"},
		SessionRevokeAllForPlayerSQL: {"COALESCE(revoked_at", "WHERE player_id = $1"},
		IdentityBanSQL:               {"banned_until", "ban_reason", "WHERE player_id = $1"},
	} {
		for _, fragment := range fragments {
			if !contains(query, fragment) {
				t.Fatalf("query %q missing %q", query, fragment)
			}
		}
	}
}

func TestPostgresSessionsRejectsInvalidArgumentsWithoutDatabase(t *testing.T) {
	sessions := PostgresSessions{}
	if _, _, err := sessions.Issue(nil, "player-1", time.Minute, time.Unix(1000, 0)); err == nil {
		t.Fatal("invalid issue accepted")
	}
	if _, err := sessions.Authenticate(nil, "session-1", "token-1", time.Unix(1000, 0)); err == nil {
		t.Fatal("invalid authentication accepted")
	}
	if err := sessions.Revoke(nil, "session-1", time.Unix(1000, 0)); err == nil {
		t.Fatal("invalid revoke accepted")
	}
}