package calls

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"
)

func cookieApp(now time.Time) *app {
	return &app{cfg: resolved{instanceKey: "k", Config: Config{Origin: "http://app.test"}}, store: &store{clk: newClock(func() time.Time { return now })}}
}

func TestJoinCookieRoundTripsAndRejectsTampering(t *testing.T) {
	now := time.Date(2026, 9, 8, 10, 0, 0, 0, time.UTC)
	a := cookieApp(now)
	rec := httptest.NewRecorder()
	hash := strings.Repeat("ab", 32)
	a.setJoinCookie(rec, hash)
	ck := rec.Result().Cookies()[0]
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.AddCookie(ck)
	got, ok := a.readJoinCookie(req)
	if !ok || got.TokenHash != hash {
		t.Fatalf("round trip failed: %+v %v", got, ok)
	}
	bad := *ck
	bad.Value = strings.Replace(bad.Value, ".", "x.", 1)
	req2 := httptest.NewRequest(http.MethodGet, "/", nil)
	req2.AddCookie(&bad)
	if _, ok := a.readJoinCookie(req2); ok {
		t.Fatal("tampered cookie accepted")
	}
	later := cookieApp(now.Add(pendingLife + time.Second))
	if _, ok := later.readJoinCookie(req); ok {
		t.Fatal("expired cookie accepted")
	}
}