using KronaStaffTerminal.Services;
using Xunit;

namespace KronaStaffTerminal.Tests;

public sealed class IpcRequestAuthenticatorTests
{
    private static readonly string Key = Convert.ToBase64String(new byte[32].Select((_, index) => (byte)index).ToArray());

    [Fact]
    public void Verify_accepts_fresh_signed_request()
    {
        var now = DateTimeOffset.UtcNow;
        var request = new IpcRequest
        {
            Command = "Ping",
            IssuedAtUnixSeconds = now.ToUnixTimeSeconds(),
            Nonce = "00112233445566778899AABBCCDDEEFF"
        };
        request.Signature = IpcRequestAuthenticator.Sign(request, Key);

        Assert.True(IpcRequestAuthenticator.Verify(request, Key, now));
    }

    [Fact]
    public void Verify_rejects_tampering_and_stale_requests()
    {
        var now = DateTimeOffset.UtcNow;
        var request = new IpcRequest
        {
            Command = "EnqueueAttendance",
            Payload = "{}",
            IssuedAtUnixSeconds = now.AddMinutes(-2).ToUnixTimeSeconds(),
            Nonce = "00112233445566778899AABBCCDDEEFF"
        };
        request.Signature = IpcRequestAuthenticator.Sign(request, Key);
        Assert.False(IpcRequestAuthenticator.Verify(request, Key, now));

        request.IssuedAtUnixSeconds = now.ToUnixTimeSeconds();
        request.Signature = IpcRequestAuthenticator.Sign(request, Key);
        request.Payload = "{\"forged\":true}";
        Assert.False(IpcRequestAuthenticator.Verify(request, Key, now));
    }
}