import {
  decodeJwtPayload,
  extractBearerToken,
  hasRecentAuthentication,
  isRecentlyAuthenticated,
  parseSessionAuthClaims,
  RECENT_AUTH_SECONDS,
  resolveAuthenticatedAt,
} from './recent-auth.ts'

function assert(condition: boolean, message: string): asserts condition {
  if (!condition) throw new Error(message)
}

function base64UrlJson(value: unknown): string {
  return btoa(JSON.stringify(value)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '')
}

function bearer(payload: Record<string, unknown>): string {
  return `Bearer ${base64UrlJson({ alg: 'HS256', typ: 'JWT' })}.${base64UrlJson(payload)}.signature`
}

const NOW = 1_800_000_000
const MONTHS_AGO = NOW - 90 * 24 * 60 * 60

Deno.test('redteam r1-20: a refreshed token (fresh iat) from an old login is NOT recent authentication', () => {
  const refreshed = bearer({
    sub: 'user-1',
    iat: NOW - 5,
    exp: NOW + 3600,
    amr: [{ method: 'password', timestamp: MONTHS_AGO }],
  })
  assert(!hasRecentAuthentication(refreshed, NOW), 'refresh_token grant must not satisfy step-up auth')
})

Deno.test('redteam r1-20: a token without amr claims is rejected even with a fresh iat', () => {
  assert(!hasRecentAuthentication(bearer({ sub: 'user-1', iat: NOW }), NOW), 'missing amr must fail closed')
  assert(!hasRecentAuthentication(bearer({ sub: 'user-1', iat: NOW, amr: [] }), NOW), 'empty amr must fail closed')
  assert(
    !hasRecentAuthentication(bearer({ sub: 'user-1', iat: NOW, amr: [{ method: 'password' }] }), NOW),
    'amr entries without timestamps must fail closed',
  )
})

Deno.test('recent sign-in (amr timestamp inside the window) is accepted', () => {
  const fresh = bearer({ sub: 'user-1', iat: NOW - 30, amr: [{ method: 'password', timestamp: NOW - 30 }] })
  assert(hasRecentAuthentication(fresh, NOW), 'fresh login must pass')
  const edge = bearer({ sub: 'user-1', iat: NOW, amr: [{ method: 'otp', timestamp: NOW - RECENT_AUTH_SECONDS }] })
  assert(hasRecentAuthentication(edge, NOW), 'exactly at the window boundary must pass')
  const stale = bearer({ sub: 'user-1', iat: NOW, amr: [{ method: 'otp', timestamp: NOW - RECENT_AUTH_SECONDS - 1 }] })
  assert(!hasRecentAuthentication(stale, NOW), 'one second past the window must fail')
})

Deno.test('the most recent amr method counts (e.g. a fresh TOTP step-up on an old password session)', () => {
  const claims = parseSessionAuthClaims({
    amr: [
      { method: 'password', timestamp: MONTHS_AGO },
      { method: 'totp', timestamp: NOW - 60 },
      'garbage',
      { method: 'oauth', timestamp: 'nope' },
    ],
  })
  assert(claims !== null && claims.amr.length === 2, 'invalid amr entries are skipped')
  assert(resolveAuthenticatedAt(claims) === NOW - 60, 'latest timestamp wins')
  assert(isRecentlyAuthenticated(resolveAuthenticatedAt(claims), NOW), 'step-up within window passes')
})

Deno.test('future authentication times beyond clock skew are rejected', () => {
  assert(isRecentlyAuthenticated(NOW + 30, NOW), 'small skew tolerated')
  assert(!isRecentlyAuthenticated(NOW + 3600, NOW), 'far-future timestamp rejected')
  assert(!isRecentlyAuthenticated(null, NOW), 'null rejected')
})

Deno.test('malformed Authorization headers fail closed', () => {
  assert(extractBearerToken(null) === null, 'null header')
  assert(extractBearerToken('Bearer   ') === null, 'blank token')
  assert(decodeJwtPayload('not-a-jwt') === null, 'no payload segment')
  assert(decodeJwtPayload('a.!!!.c') === null, 'invalid base64')
  assert(decodeJwtPayload(`a.${base64UrlJson([1, 2])}.c`) === null, 'array payload')
  assert(!hasRecentAuthentication('Bearer a.!!!.c', NOW), 'malformed token rejected')
})