package domain

import (
	"errors"
	"testing"
	"time"
)

func TestTicketVerifierBindsAppIdentityExpiryAndSingleUse(t *testing.T) {
	now := time.Unix(1000, 0)
	verifier, _ := NewTicketVerifier(480)
	ticket := SteamTicket{TicketID: "ticket-1", SteamID: "steam-1", AppID: 480, ExpiresAt: now.Add(time.Minute)}
	resolve := func(steamID string) (string, bool) { return "player-1", steamID == "steam-1" }
	identity, err := verifier.Verify(ticket, resolve, now)
	if err != nil || identity.PlayerID != "player-1" || identity.SteamID != "steam-1" {
		t.Fatalf("identity = %+v err=%v", identity, err)
	}
	if _, err := verifier.Verify(ticket, resolve, now); !errors.Is(err, ErrTicketRejected) {
		t.Fatalf("ticket replay accepted: %v", err)
	}
	wrong := ticket
	wrong.TicketID = "ticket-2"
	wrong.AppID = 481
	if _, err := verifier.Verify(wrong, resolve, now); !errors.Is(err, ErrTicketRejected) {
		t.Fatalf("wrong app accepted: %v", err)
	}
	expired := ticket
	expired.TicketID = "ticket-3"
	expired.ExpiresAt = now
	if _, err := verifier.Verify(expired, resolve, now); !errors.Is(err, ErrTicketRejected) {
		t.Fatalf("expired ticket accepted: %v", err)
	}
	unknown := ticket
	unknown.TicketID = "ticket-4"
	unknown.SteamID = "steam-unknown"
	if _, err := verifier.Verify(unknown, resolve, now); !errors.Is(err, ErrTicketRejected) {
		t.Fatalf("unresolved SteamID accepted: %v", err)
	}
}

func TestSessionIsOpaqueShortLivedAndRevocable(t *testing.T) {
	now := time.Unix(1000, 0)
	store := NewSessionStore()
	session, token, err := store.Issue("player-1", time.Minute, now)
	if err != nil || token == "" || session.PlayerID != "player-1" {
		t.Fatalf("issue = %+v token=%q err=%v", session, token, err)
	}
	if _, err := store.Authenticate(session.SessionID, "wrong", now); !errors.Is(err, ErrSessionRejected) {
		t.Fatalf("wrong token accepted: %v", err)
	}
	if got, err := store.Authenticate(session.SessionID, token, now.Add(59*time.Second)); err != nil || got.SessionID != session.SessionID {
		t.Fatalf("valid auth = %+v err=%v", got, err)
	}
	if err := store.Revoke(session.SessionID, now); err != nil {
		t.Fatal(err)
	}
	if _, err := store.Authenticate(session.SessionID, token, now); !errors.Is(err, ErrSessionRejected) {
		t.Fatalf("revoked session accepted: %v", err)
	}
	if _, err := store.Authenticate(session.SessionID, token, now.Add(time.Minute)); !errors.Is(err, ErrSessionRejected) {
		t.Fatalf("expired session accepted: %v", err)
	}
}