import { expect, test } from "bun:test";
import { createSecretBox } from "../src/crypto";

test("round trips and uses a fresh IV each time", async () => {
  const box = createSecretBox("s3cret");
  const a = await box.encrypt("sk-ant-123");
  const b = await box.encrypt("sk-ant-123");
  expect(a).not.toBe(b);
  expect(a).not.toContain("sk-ant-123");
  expect(a.startsWith("v1.")).toBe(true);
  expect(await box.decrypt(a)).toBe("sk-ant-123");
  expect(await box.decrypt(b)).toBe("sk-ant-123");
});

test("another secret cannot decrypt", async () => {
  const token = await createSecretBox("one").encrypt("key");
  await expect(createSecretBox("two").decrypt(token)).rejects.toThrow();
});

test("a tampered token is rejected", async () => {
  const token = await createSecretBox("one").encrypt("key");
  const parts = token.split(".");
  const ct = Buffer.from(parts[2]!, "base64");
  ct[0] = ct[0]! ^ 1;
  await expect(createSecretBox("one").decrypt(`${parts[0]}.${parts[1]}.${ct.toString("base64")}`)).rejects.toThrow();
  await expect(createSecretBox("one").decrypt("garbage")).rejects.toThrow();
});