package identity

import (
	"testing"
	"time"
)

func TestHOTPUsesRFC6238Vector(t *testing.T) {
	// RFC 6238 SHA-1 shared secret, time 59 seconds, 8-digit expected value.
	code, err := hotp("GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ", 59/30, 8)
	if err != nil {
		t.Fatal(err)
	}
	if code != "94287082" {
		t.Fatalf("got %s", code)
	}
}

func TestVerifyTOTPAcceptsWindow(t *testing.T) {
	now := time.Unix(1_700_000_000, 0)
	secret := "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"
	code, err := hotp(secret, now.Unix()/30-1, 6)
	if err != nil {
		t.Fatal(err)
	}
	step, ok := VerifyTOTP(secret, code, now)
	if !ok || step != now.Unix()/30-1 {
		t.Fatalf("step=%d ok=%v", step, ok)
	}
}

func TestBackupCodeNormalization(t *testing.T) {
	if HashBackupCode("abcd-2345") != HashBackupCode(" ABCD2345 ") {
		t.Fatal("backup code normalization differs")
	}
	codes, records, err := GenerateBackupCodes()
	if err != nil {
		t.Fatal(err)
	}
	if len(codes) != 10 || len(records) != 10 || records[0].Hash != HashBackupCode(codes[0]) {
		t.Fatal("invalid backup code generation")
	}
}