package jwt

import (
	"testing"
	"time"
)

func TestSignParseAccess(t *testing.T) {
	m := NewManager("test-secret", "openteam", time.Hour, 24*time.Hour)
	tok, exp, err := m.Sign(42, "alice", "admin", "access")
	if err != nil {
		t.Fatalf("Sign: %v", err)
	}
	if exp.Before(time.Now()) {
		t.Fatal("expires in the past")
	}
	claims, err := m.Parse(tok)
	if err != nil {
		t.Fatalf("Parse: %v", err)
	}
	if claims.UserID != 42 || claims.Username != "alice" || claims.Role != "admin" {
		t.Fatalf("claims mismatch: %+v", claims)
	}
	if claims.Subject != "access" {
		t.Fatalf("subject mismatch: %s", claims.Subject)
	}
}

func TestParseRejectsBadToken(t *testing.T) {
	m := NewManager("test-secret", "openteam", time.Hour, 24*time.Hour)
	if _, err := m.Parse("not-a-jwt"); err == nil {
		t.Fatal("expected error for invalid token")
	}
}

func TestExpiredToken(t *testing.T) {
	m := NewManager("test-secret", "openteam", -time.Hour, -time.Hour)
	tok, _, err := m.Sign(1, "bob", "user", "access")
	if err != nil {
		t.Fatalf("Sign: %v", err)
	}
	if _, err := m.Parse(tok); err == nil {
		t.Fatal("expected error for expired token")
	}
}