package com.baiyue.auth.controller;

import com.baiyue.auth.config.UnifiedJwtProperties;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.KeyUse;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.util.Base64URL;
import org.junit.jupiter.api.Test;

import java.math.BigInteger;
import java.time.Duration;
import java.util.List;

import static org.assertj.core.api.Assertions.assertThat;

class JwksControllerTest {
    @Test
    void publishesOnlyPublicKeyMaterialForCurrentAndPreviousKeys() throws Exception {
        RSAKey current = key("current", true);
        RSAKey previous = key("previous", false);
        String json = new JWKSet(List.of(current, previous)).toString(false);
        var properties = new UnifiedJwtProperties(json, "current");

        var body = new JwksController(properties).jwks().getBody();
        String published = new com.fasterxml.jackson.databind.ObjectMapper().writeValueAsString(body);

        assertThat(published).contains("current", "previous", "\"n\"", "\"e\"")
            .doesNotContain("\"d\"", "\"p\"", "\"q\"", "\"dp\"", "\"dq\"", "\"qi\"");
    }

    private RSAKey key(String kid, boolean privatePart) {
        RSAKey.Builder builder = new RSAKey.Builder(
            Base64URL.encode(BigInteger.valueOf(3233)), Base64URL.encode(BigInteger.valueOf(17)))
            .keyID(kid).keyUse(KeyUse.SIGNATURE).algorithm(JWSAlgorithm.RS256);
        if (privatePart) builder.privateExponent(Base64URL.encode(BigInteger.valueOf(2753)));
        return builder.build();
    }
}