package operator

import (
	"encoding/base64"
	"math"
	"testing"
	"time"

	family "amadan.net/rastrillo/rastrillo/crypto"
)

func TestPinnedSqidVectorsAndReservedInteger(t *testing.T) {
	for n, want := range map[int64]string{1: "Uk", 2: "gb", 3: "Ef", 1000: "pnd", math.MaxInt64: "AqkYhRmbHpEX"} {
		got, e := TeamSQID(n)
		if e != nil || got != want {
			t.Fatal(n, got, e)
		}
		decoded := teamCodec.Decode(got)
		if len(decoded) != 1 || decoded[0] != uint64(n) {
			t.Fatal("roundtrip")
		}
	}
	for _, n := range []int64{0, -1, math.MinInt64} {
		if _, e := TeamSQID(n); e != ErrRefused {
			t.Fatal("invalid ID")
		}
	}
	if validTeam(1, "gb") || validTeam(1, "Ukextra") {
		t.Fatal("alternate mapping")
	}
}
func TestOwnerReceiptBoundIdentityAndFreshness(t *testing.T) {
	k, e := family.Generate()
	if e != nil {
		t.Fatal(e)
	}
	p := OwnerReceipt{1, "owner-seed", token(7), "https://id.oficina.works", "https://oficina.works", 1, "Uk", "pr_aaaaaaaaaaaaaaaaaaaaaaaaaa", "owner", 2000000000, 2000000300}
	raw, e := SignOwner(k, p)
	if e != nil {
		t.Fatal(e)
	}
	v, e := NewOwnerVerifier(base64.RawURLEncoding.EncodeToString(k.SignPub()), p.Issuer, p.Directory)
	if e != nil {
		t.Fatal(e)
	}
	got, e := v.Verify(raw, time.Unix(p.Issued, 0))
	if e != nil || got != p {
		t.Fatal(e)
	}
	for _, n := range []int64{p.Issued - 1, p.Expires, p.Expires + 1} {
		if _, e := v.Verify(raw, time.Unix(n, 0)); e != ErrRefused {
			t.Fatal("freshness")
		}
	}
	foreign, e := NewOwnerVerifier(base64.RawURLEncoding.EncodeToString(k.SignPub()), p.Issuer, "https://other.oficina.works")
	if e != nil {
		t.Fatal(e)
	}
	if _, e = foreign.Verify(raw, time.Unix(p.Issued, 0)); e != ErrRefused {
		t.Fatal("foreign directory")
	}
	p.TeamSQID = "gb"
	if _, e = SignOwner(k, p); e != ErrRefused {
		t.Fatal("mismatched team")
	}
	p.TeamSQID = "Uk"
	p.Role = "member"
	if _, e = SignOwner(k, p); e != ErrRefused {
		t.Fatal("nonowner")
	}
}