use bucketwarden_auth::{AccessKey, AuthError, AuthStore, SessionCredential};

#[test]
fn session_credentials_require_parent_identity_and_expire() {
    let mut store = AuthStore::new();
    store.create_local_user("alice");
    store
        .put_access_key(AccessKey::active("alice", "AKIAPARENT", "parent-secret"))
        .expect("parent");
    store
        .put_session(SessionCredential::new(
            "alice",
            "AKIAPARENT",
            "ASIATEMP",
            "session-secret",
            "token-1",
            50,
        ))
        .expect("session");

    let current = store.resolve_credential("ASIATEMP", 49).expect("current");
    assert_eq!(current.principal_id, "alice");
    assert_eq!(
        current.credentials.session_token.as_deref(),
        Some("token-1")
    );
    assert!(matches!(
        store.resolve_credential("ASIATEMP", 51),
        Err(AuthError::ExpiredCredential(_))
    ));
}

#[test]
fn revoked_sessions_are_rejected() {
    let mut store = AuthStore::new();
    store.create_local_user("alice");
    store
        .put_access_key(AccessKey::active("alice", "AKIAPARENT", "parent-secret"))
        .expect("parent");
    store
        .put_session(SessionCredential::new(
            "alice",
            "AKIAPARENT",
            "ASIATEMP",
            "session-secret",
            "token-1",
            50,
        ))
        .expect("session");

    store.revoke_credential("ASIATEMP", 20).expect("revoke");

    assert!(matches!(
        store.resolve_credential("ASIATEMP", 21),
        Err(AuthError::RevokedCredential(_))
    ));
}
