package oidc

import (
	"fmt"
	"sync"
	"testing"
	"time"

	"keycape/internal/domain"
)

func TestTokenStatusExactExpiryCapacityAndTombstones(t *testing.T) {
	client := &domain.Client{ClientID: "synthetic-client", ClientType: "public"}
	clients := map[string]*domain.Client{client.ClientID: client}
	store, _ := NewTokenStatusStore(1)
	now := time.Unix(1700000000, 0)
	end := now.Add(time.Second)
	if store.register("synthetic-first", client, end, now) != nil {
		t.Fatal("register refused")
	}
	if _, active := store.active("synthetic-first", clients, end); active {
		t.Fatal("expiry equality accepted")
	}
	store.revoke("synthetic-first", client.ClientID)
	if store.register("synthetic-first", client, end, now) == nil {
		t.Fatal("revoked token reactivated")
	}
	if store.register("synthetic-second", client, end.Add(time.Second), end) != nil {
		t.Fatal("expired tombstone not collected")
	}
	if _, active := store.active("synthetic-second", clients, end); !active {
		t.Fatal("fresh token refused")
	}
	for _, capacity := range []int{-1, 0, 1000001} {
		if _, err := NewTokenStatusStore(capacity); err == nil {
			t.Fatal("unbounded capacity accepted")
		}
	}
}

func TestTokenStatusConcurrentIssueReadAndRevoke(t *testing.T) {
	store, _ := NewTokenStatusStore(128)
	client := &domain.Client{ClientID: "synthetic-client", ClientType: "public"}
	clients := map[string]*domain.Client{client.ClientID: client}
	now := time.Now()
	var wg sync.WaitGroup
	for i := 0; i < 64; i++ {
		wg.Add(1)
		go func(i int) {
			defer wg.Done()
			raw := fmt.Sprintf("synthetic-token-%d", i)
			if store.register(raw, client, now.Add(time.Minute), now) != nil {
				t.Error("concurrent registration failed")
				return
			}
			if _, active := store.active(raw, clients, now); !active {
				t.Error("concurrent current token refused")
			}
			store.revoke(raw, client.ClientID)
			if _, active := store.active(raw, clients, now); active {
				t.Error("concurrent revoked token accepted")
			}
		}(i)
	}
	wg.Wait()
}