package jwt

import (
	"testing"
	"time"
)

func TestSignParse(t *testing.T) {
	m := NewManager("test-secret", "openteam", time.Hour, 24*time.Hour)
	tok, exp, err := m.Sign(42, "alice", "admin", "access")
	if err != nil {
		t.Fatal(err)
	}
	if time.Until(exp) < 50*time.Minute {
		t.Fatal("expiry too short")
	}
	claims, err := m.Parse(tok)
	if err != nil {
		t.Fatal(err)
	}
	if claims.UserID != 42 || claims.Username != "alice" || claims.Role != "admin" || claims.Subject != "access" {
		t.Fatalf("claims mismatch: %+v", claims)
	}
}

func TestExpiredToken(t *testing.T) {
	m := NewManager("test-secret", "openteam", -time.Minute, time.Hour)
	tok, _, _ := m.Sign(1, "a", "user", "access")
	if _, err := m.Parse(tok); err == nil {
		t.Fatal("expired token should fail")
	}
}

func TestWrongSecret(t *testing.T) {
	m1 := NewManager("secret-a", "openteam", time.Hour, time.Hour)
	m2 := NewManager("secret-b", "openteam", time.Hour, time.Hour)
	tok, _, _ := m1.Sign(1, "a", "user", "access")
	if _, err := m2.Parse(tok); err == nil {
		t.Fatal("token signed with different secret should fail")
	}
}