import assert from 'node:assert/strict';
import test from 'node:test';
import { adminSignature, hmacHex, verifyAdminSignature, verifyHexHmac } from '../src/auth.mjs';

test('Gitea HMAC verifies the exact raw body', () => {
  const body = Buffer.from('{"ref":"refs/heads/master"}');
  const signature = hmacHex('a'.repeat(32), body);
  assert.equal(verifyHexHmac('a'.repeat(32), body, signature), true);
  assert.equal(verifyHexHmac('a'.repeat(32), Buffer.from(`${body} `), signature), false);
  assert.equal(verifyHexHmac('a'.repeat(32), body, 'not-a-signature'), false);
});

test('admin signatures bind timestamp, request ID, and body with a five-minute window', () => {
  const secret = 'b'.repeat(32);
  const now = 1_786_013_000_000;
  const timestamp = String(now);
  const requestId = 'request-1234';
  const body = Buffer.from('{"branch":"master"}');
  const supplied = adminSignature(secret, timestamp, requestId, body);
  assert.equal(verifyAdminSignature({ secret, timestamp, requestId, body, supplied, now }), true);
  assert.equal(verifyAdminSignature({ secret, timestamp: String(now - 300_001), requestId, body, supplied, now }), false);
  assert.equal(verifyAdminSignature({ secret, timestamp, requestId: 'changed-id', body, supplied, now }), false);
});