from datetime import datetime, timedelta, timezone

import pytest


def test_access_token_contains_only_identity_claims():
    from app.core.system.tokens import decode_access_token, issue_access_token

    token = issue_access_token(
        user_id="01900000-0000-7000-8000-000000000001",
        roles=["viewer"],
        secret="test-secret-that-is-long-enough",
        now=datetime(2026, 7, 16, tzinfo=timezone.utc),
        lifetime=timedelta(minutes=15),
    )
    claims = decode_access_token(
        token,
        secret="test-secret-that-is-long-enough",
        now=datetime(2026, 7, 16, 0, 5, tzinfo=timezone.utc),
    )

    assert set(claims) == {"sub", "roles", "iat", "exp", "jti"}
    assert claims["roles"] == ["viewer"]


def test_expired_and_tampered_tokens_are_rejected():
    from app.core.system.tokens import TokenError, decode_access_token, issue_access_token

    now = datetime(2026, 7, 16, tzinfo=timezone.utc)
    token = issue_access_token(
        user_id="01900000-0000-7000-8000-000000000001",
        roles=["admin"],
        secret="test-secret-that-is-long-enough",
        now=now,
        lifetime=timedelta(seconds=1),
    )

    with pytest.raises(TokenError):
        decode_access_token(
            token,
            secret="test-secret-that-is-long-enough",
            now=now + timedelta(seconds=2),
        )
    with pytest.raises(TokenError):
        decode_access_token(
            token + "tampered",
            secret="test-secret-that-is-long-enough",
            now=now,
        )