import { describe, expect, test } from "bun:test";
import { verifyBasicAuth } from "../src/gateway.ts";

const pairs = [
  { user: "admin", pass: "hunter2" },
  { user: "ops", pass: "p:a:s:s" },
];

const basic = (raw: string) => `Basic ${btoa(raw)}`;

describe("gateway basic auth", () => {
  test("accepts a configured pair", () => {
    expect(verifyBasicAuth(basic("admin:hunter2"), pairs)).toBe(true);
  });

  test("accepts a password containing colons", () => {
    // split(":", 2) used to truncate this to "p", so it could never match.
    expect(verifyBasicAuth(basic("ops:p:a:s:s"), pairs)).toBe(true);
  });

  test("rejects wrong credentials", () => {
    expect(verifyBasicAuth(basic("admin:wrong"), pairs)).toBe(false);
    expect(verifyBasicAuth(basic("nobody:hunter2"), pairs)).toBe(false);
  });

  test("fails closed on malformed input instead of throwing", () => {
    // An unauthenticated request must not be able to raise a 500 here.
    expect(() => verifyBasicAuth("Basic !!!!not-base64", pairs)).not.toThrow();
    expect(verifyBasicAuth("Basic !!!!not-base64", pairs)).toBe(false);
    expect(verifyBasicAuth(basic("no-colon-at-all"), pairs)).toBe(false);
    expect(verifyBasicAuth("Bearer token", pairs)).toBe(false);
    expect(verifyBasicAuth(null, pairs)).toBe(false);
    expect(verifyBasicAuth(undefined, pairs)).toBe(false);
    expect(verifyBasicAuth("", pairs)).toBe(false);
  });

  test("empty credentials never match", () => {
    expect(verifyBasicAuth(basic(":"), pairs)).toBe(false);
  });
});