import { describe, expect, it } from 'vitest';
import { generateSessionToken, hashSessionToken } from '../infrastructure/session-token.js';

describe('session tokens', () => {
  it('generates unique URL-safe tokens', () => {
    const tokens = new Set<string>();
    for (let i = 0; i < 100; i += 1) {
      tokens.add(generateSessionToken());
    }
    expect(tokens.size).toBe(100);
    for (const token of tokens) {
      expect(token).toMatch(/^[A-Za-z0-9_-]+$/);
      expect(token.length).toBeGreaterThanOrEqual(80);
    }
  });

  it('hashes deterministically to hex sha256, never the raw token', () => {
    const token = generateSessionToken();
    const hash1 = hashSessionToken(token);
    const hash2 = hashSessionToken(token);
    expect(hash1).toBe(hash2);
    expect(hash1).toMatch(/^[0-9a-f]{64}$/);
    expect(hash1).not.toBe(token);
  });

  it('different tokens produce different hashes', () => {
    const a = generateSessionToken();
    const b = generateSessionToken();
    expect(hashSessionToken(a)).not.toBe(hashSessionToken(b));
  });
});
