// Short-lived "Open in slicer" download links (lib/handoff.js).
const test = require('node:test');
const assert = require('node:assert/strict');
const jwt = require('jsonwebtoken');
const handoff = require('../lib/handoff');

const SECRET = 'a'.repeat(96);

test('a link grants the file it was made for', () => {
  const token = handoff.createToken(SECRET, { kind: 'entry', id: '42' });
  assert.deepEqual(handoff.readToken(SECRET, token), { kind: 'entry', id: 42 });
});

test('expired, altered or foreign links grant nothing', () => {
  const expired = handoff.createToken(SECRET, { kind: 'file', id: 1 }, -5);
  assert.equal(handoff.readToken(SECRET, expired), null);

  const token = handoff.createToken(SECRET, { kind: 'file', id: 1 });
  const [head, , sig] = token.split('.');
  const otherBody = Buffer.from(JSON.stringify({ k: 'file', id: 2, aud: 'printhive-handoff', exp: 9999999999 })).toString('base64url');
  assert.equal(handoff.readToken(SECRET, `${head}.${otherBody}.${sig}`), null);
  assert.equal(handoff.readToken('b'.repeat(96), token), null);
  assert.equal(handoff.readToken(SECRET, 'not-a-token'), null);
});

test('a login token is not a hand-off link', () => {
  const session = jwt.sign({ sub: 1, email: 'x@example.com' }, SECRET, { expiresIn: '30d' });
  assert.equal(handoff.readToken(SECRET, session), null);
  // …and a hand-off link doesn't verify as a login.
  assert.throws(() => jwt.verify(handoff.createToken(SECRET, { kind: 'file', id: 1 }), SECRET));
});

test('only files and archive entries can be handed off', () => {
  assert.throws(() => handoff.createToken(SECRET, { kind: 'model', id: 1 }), /Unknown hand-off kind/);
});

test('link file names stay plain ASCII and keep their extension', () => {
  assert.equal(handoff.urlName('Toy Keychain (v2).3mf'), 'Toy_Keychain_v2.3mf');
  assert.equal(handoff.urlName('Café déco.STL'), 'Cafe_deco.stl');
  assert.equal(handoff.urlName('日本.stl'), 'model.stl');
  assert.equal(handoff.urlName('../../etc/passwd.obj'), 'passwd.obj');
});