package authcommon

import (
	"context"
	"testing"

	"cmroubao/backend-api/internal/domain"
)

func TestPrincipalRoundTrip(t *testing.T) {
	want := domain.AuthPrincipal{
		UserID:   "user-1",
		Username: "buyer",
		Role:     domain.UserRoleBuyer,
		DeviceID: "device-1",
	}
	ctx := WithPrincipal(context.Background(), want)

	got, ok := Principal(ctx)

	if !ok || got != want {
		t.Fatalf("Principal() = %+v, %t", got, ok)
	}
}

func TestValidCSRFPairRequiresOneCanonical256BitValue(t *testing.T) {
	valid := "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE"
	if !ValidCSRFPair(valid, valid) {
		t.Fatal("valid CSRF pair was rejected")
	}
	for _, candidate := range []string{
		"",
		"short",
		valid + "=",
		valid[:len(valid)-1] + "b",
	} {
		if ValidCSRFPair(valid, candidate) {
			t.Fatalf("invalid presented value %q was accepted", candidate)
		}
	}
}