package auth

import (
	"testing"
	"time"
)

func TestParseSubjectReportsSafeFailureReason(t *testing.T) {
	manager := NewJWTManager("test-jwt-secret-for-failure-reason")
	pair, err := manager.GenerateSubjectPairWithVersion(1, "admin", "admin", 1)
	if err != nil {
		t.Fatalf("GenerateSubjectPairWithVersion() error = %v", err)
	}

	tests := []struct {
		name      string
		manager   *JWTManager
		token     string
		tokenType string
		want      string
	}{
		{
			name:      "签名不匹配",
			manager:   NewJWTManager("another-jwt-secret-for-failure-reason"),
			token:     pair.AccessToken,
			tokenType: "access",
			want:      "signature_invalid",
		},
		{
			name:      "令牌类型不匹配",
			manager:   manager,
			token:     pair.AccessToken,
			tokenType: "refresh",
			want:      "token_type",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			_, err := tt.manager.ParseSubject(tt.token, tt.tokenType, "admin")
			if err == nil {
				t.Fatal("ParseSubject() error = nil")
			}
			if got := TokenFailureReason(err); got != tt.want {
				t.Fatalf("TokenFailureReason() = %q, want %q", got, tt.want)
			}
		})
	}

	t.Run("令牌已过期", func(t *testing.T) {
		expiredManager := NewJWTManager("test-jwt-secret-for-expired-token")
		expiredManager.accessTTL = -time.Minute
		expiredPair, err := expiredManager.GenerateSubjectPairWithVersion(1, "admin", "admin", 1)
		if err != nil {
			t.Fatalf("GenerateSubjectPairWithVersion() error = %v", err)
		}
		_, err = expiredManager.ParseSubject(expiredPair.AccessToken, "access", "admin")
		if got := TokenFailureReason(err); got != "expired" {
			t.Fatalf("TokenFailureReason() = %q, want %q", got, "expired")
		}
	})
}