from datetime import timedelta

from jose import jwt

from app.core.config import Settings
from app.core.security import (
    ALGORITHM,
    TOKEN_TYPE_USER,
    create_user_access_token,
    decode_user_access_token,
    hash_password,
    verify_password,
)


def test_password_hashing_roundtrip() -> None:
    hashed = hash_password("my-secret-password")
    assert hashed != "my-secret-password"
    assert verify_password("my-secret-password", hashed)
    assert not verify_password("wrong", hashed)


def test_jwt_expiration_claim() -> None:
    settings = Settings(
        environment="development",
        database_url="postgresql://localhost/test",
        secret_key="unit-test-secret-key-at-least-32-chars",
        access_token_expire_minutes=30,
    )
    token = create_user_access_token(42, settings)
    payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM])
    assert payload["sub"] == "42"
    assert payload["type"] == TOKEN_TYPE_USER
    assert "exp" in payload

    user_id = decode_user_access_token(token, settings)
    assert user_id == 42


def test_jwt_rejects_wrong_type() -> None:
    settings = Settings(
        environment="development",
        database_url="postgresql://localhost/test",
        secret_key="unit-test-secret-key-at-least-32-chars",
        access_token_expire_minutes=30,
    )
    from datetime import datetime, timezone

    expire = datetime.now(timezone.utc) + timedelta(minutes=5)
    admin_style = jwt.encode(
        {"sub": "admin@example.com", "exp": expire, "type": "admin"},
        settings.secret_key,
        algorithm=ALGORITHM,
    )
    assert decode_user_access_token(admin_style, settings) is None