import assert from 'node:assert/strict'
import test from 'node:test'
import { decodeMerchantToken } from './jwt.ts'

function tokenFor(payload) {
  const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url')
  return `header.${encoded}.signature`
}

const payload = {
  user_id: 1001,
  username: 'merchant_admin',
  tenant_id: 2001,
  membership_id: 3001,
  app_code: 'MERCHANT',
  roles: ['MERCHANT_OWNER'],
  permissions: ['merchant:profile:view'],
  exp: 1900000000,
}

test('decodes a merchant JWT payload for UI identity and permissions', () => {
  assert.deepEqual(decodeMerchantToken(tokenFor(payload)), payload)
})

test('rejects tokens from the platform application domain', () => {
  assert.throws(() => decodeMerchantToken(tokenFor({ ...payload, app_code: 'PLATFORM' })), /账号不属于当前应用端/)
})

test('rejects malformed tokens', () => {
  assert.throws(() => decodeMerchantToken('not-a-jwt'), /登录凭证格式无效/)
})