import assert from "node:assert/strict";
import test from "node:test";
import { SessionManager } from "../src/auth.js";

test("session manager expires and revokes opaque sessions", () => {
  let now = Date.parse("2026-08-02T00:00:00.000Z");
  const sessions = new SessionManager({
    username: "operator",
    password: "secret",
    sessionTtlMs: 60_000,
    cookieSecure: true
  }, () => now);

  assert.equal(sessions.credentialsMatch("operator", "secret"), true);
  assert.equal(sessions.credentialsMatch("operator", "wrong"), false);
  assert.equal(sessions.credentialsMatch("wrong", "secret"), false);

  const created = sessions.create();
  const cookie = sessions.sessionCookie(created.token);
  assert.match(cookie, /^condon_session=[A-Za-z0-9_-]+;/);
  assert.match(cookie, /HttpOnly/);
  assert.match(cookie, /SameSite=Lax/);
  assert.match(cookie, /Secure/);
  assert.match(cookie, /Max-Age=60/);
  assert.equal(cookie.includes("secret"), false);

  const requestCookie = cookie.split(";", 1)[0];
  assert.equal(sessions.get(requestCookie)?.username, "operator");
  now += 60_001;
  assert.equal(sessions.get(requestCookie), null);

  const replacement = sessions.create();
  const replacementCookie = sessions.sessionCookie(replacement.token).split(";", 1)[0];
  sessions.revoke(replacementCookie);
  assert.equal(sessions.get(replacementCookie), null);
  assert.match(sessions.clearedCookie(), /Max-Age=0/);
});