import { generateToken, hashToken } from '../../src/uploadLinks';

describe('generateToken', () => {
  it('produces a URL-safe token with no padding', () => {
    expect(generateToken()).toMatch(/^[A-Za-z0-9_-]{43}$/);
  });

  // The token is the entire access control on the intake endpoint. If two
  // calls could collide, one person's link would open another's.
  it('does not repeat', () => {
    const seen = new Set(Array.from({ length: 1000 }, () => generateToken()));
    expect(seen.size).toBe(1000);
  });
});

describe('hashToken', () => {
  it('is a lowercase hex sha256 digest', () => {
    expect(hashToken('abc')).toBe(
      'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'
    );
  });

  it('is stable across calls, so a stored digest keeps matching', () => {
    const token = generateToken();
    expect(hashToken(token)).toBe(hashToken(token));
  });

  it('gives different tokens different digests', () => {
    expect(hashToken(generateToken())).not.toBe(hashToken(generateToken()));
  });
});