package security

import (
	"context"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// --- TokenBlacklistService tests (using nil Redis - should handle gracefully) ---

func TestNewTokenBlacklistService_Cov2(t *testing.T) {
	svc := NewTokenBlacklistService(nil, nil)
	assert.NotNil(t, svc)
}

func TestTokenBlacklistService_Blacklist_ExpiredToken_Cov2(t *testing.T) {
	svc := NewTokenBlacklistService(nil, nil)
	// Token already expired - should return nil (no-op)
	err := svc.Blacklist(context.Background(), "expired-token", time.Now().Add(-1*time.Hour))
	assert.NoError(t, err)
}

func TestTokenBlacklistService_TestWrite_Cov2(t *testing.T) {
	// TestWrite is a trivial function
	TestWrite()
}

// --- WebhookSignatureService tests ---

func TestWebhookSignatureService_VerifyMetaWebhook_Cov2(t *testing.T) {
	svc := NewWebhookSignatureService(DefaultWebhookSignatureConfig())
	err := svc.VerifyMetaWebhook("secret", []byte("payload"), "invalid-signature")
	// Should return error (invalid signature)
	assert.Error(t, err)
}

func TestWebhookSignatureService_VerifyTelegramWebhook_Cov2(t *testing.T) {
	svc := NewWebhookSignatureService(DefaultWebhookSignatureConfig())
	err := svc.VerifyTelegramWebhook("secret", "wrong-token", "")
	// Should return error (token mismatch)
	assert.Error(t, err)
}

func TestWebhookSignatureService_VerifyTelegramWebhook_Match_Cov2(t *testing.T) {
	svc := NewWebhookSignatureService(DefaultWebhookSignatureConfig())
	err := svc.VerifyTelegramWebhook("correct-secret", "correct-secret", "")
	// Should not return error (token match)
	require.NoError(t, err)
}

// --- JWT Claims tests ---

func TestClaims_Struct_Cov2(t *testing.T) {
	c := Claims{
		UserID:    1,
		AccountID: 2,
		Role:      "admin",
	}
	assert.Equal(t, uint(1), c.UserID)
	assert.Equal(t, "admin", c.Role)
}