import { describe, expect, it } from "@effect/vitest";

import { decodeLoginState, encodeLoginState } from "./login-state";

// The OAuth state parameter carries { nonce, returnTo } through the WorkOS
// round trip. It crosses a trust boundary twice (authorize URL out, callback
// query in), so decoding must be total — junk reads as null, never a throw.
describe("login state codec", () => {
  it("round-trips nonce + returnTo", () => {
    const state = { nonce: "a".repeat(64), returnTo: "/integrations/sentry?addAccount=1" };
    expect(decodeLoginState(encodeLoginState(state))).toEqual(state);
  });

  it("round-trips a state without returnTo", () => {
    const state = { nonce: "b".repeat(64) };
    expect(decodeLoginState(encodeLoginState(state))).toEqual(state);
  });

  it("is URL-safe verbatim (no characters that need query escaping)", () => {
    const encoded = encodeLoginState({ nonce: "c".repeat(64), returnTo: "/tools?q=a b&x=+/" });
    expect(encoded).toMatch(/^[A-Za-z0-9_-]+$/);
  });

  // The callback can be reached by WorkOS-initiated redirects whose state we
  // never minted, and by anyone typing a URL.
  const junk = [
    null,
    undefined,
    "", // absent
    "not-base64url!!", // invalid alphabet
    "aGVsbG8", // valid base64url, not JSON ("hello")
    "eyJmb28iOiJiYXIifQ", // valid JSON, wrong shape ({"foo":"bar"})
  ];
  for (const value of junk) {
    it(`reads ${JSON.stringify(value)} as null`, () => {
      expect(decodeLoginState(value)).toBeNull();
    });
  }
});