import { describe, expect, it } from "vitest";
import { sealData, unsealData } from "iron-session";
import {
  DEVELOPMENT_SESSION_SECRET,
  getSessionOptions,
} from "./sessionConfig";

describe("session configuration", () => {
  it.each([undefined, "", "short", DEVELOPMENT_SESSION_SECRET])(
    "rejects invalid production secret %s",
    (secret) => {
      expect(() =>
        getSessionOptions({ NODE_ENV: "production", SESSION_SECRET: secret })
      ).toThrow(/SESSION_SECRET/);
    }
  );

  it("allows the labelled fallback only outside production", () => {
    expect(getSessionOptions({ NODE_ENV: "development" }).password).toBe(
      DEVELOPMENT_SESSION_SECRET
    );
  });

  it("honors secure cookies only when explicitly enabled in production", () => {
    const options = getSessionOptions({
      NODE_ENV: "production",
      SESSION_SECRET: "a-secure-production-secret-that-is-long-enough",
      SECURE_COOKIES: "true",
    });
    expect(options.cookieOptions?.secure).toBe(true);
  });

  it("does not authenticate data sealed with the development fallback under a real secret", async () => {
    const sealed = await sealData(
      { isAuthenticated: true },
      { password: DEVELOPMENT_SESSION_SECRET, ttl: 60 }
    );
    await expect(unsealData(sealed, {
      password: "a-secure-production-secret-that-is-long-enough",
      ttl: 60,
    })).resolves.toEqual({});
  });
});