builder_test.go

package crum_test

import (
	"net/http"
	"strings"
	"testing"
	"time"

	"github.com/struct0x/crum"
)

func fixedTime() time.Time {
	return time.Date(2025, 1, 2, 15, 4, 5, 0, time.UTC)
}

func TestDefaults(t *testing.T) {
	c, err := crum.NewCookie("sid", "abc").Build()
	assert(t, err == nil, "expecting nil got %v", err)

	assert(t, c.Name == "sid", "Name = %q, want sid", c.Name)
	assert(t, c.Value == "abc", "Value = %q, want abc", c.Value)
	assert(t, c.Path == "/", "Path = %q, want /", c.Path)
	assert(t, c.Secure, "Secure default false, want true")
	assert(t, c.HttpOnly, "HttpOnly default false, want true")
	assert(t, c.SameSite == http.SameSiteLaxMode, "SameSite = %v, want Lax", c.SameSite)
	assert(t, c.Expires.IsZero(), "Expires set on session cookie, want zero")
	assert(t, c.MaxAge == 0, "MaxAge = %d, want 0 (omitted)", c.MaxAge)
}

func TestPathAndDomainNormalization(t *testing.T) {
	c, err := crum.NewCookie("k", "v").
		Path(""). // should normalize to "/"
		Domain(".example.com").
		Build()
	assert(t, err == nil, "expecting nil got %v", err)

	assert(t, c.Path == "/", "Path normalize: got %q, want /", c.Path)
	assert(t, c.Domain == "example.com", "Domain normalize: got %q, want example.com", c.Domain)
}

func TestTTLCoherence_SetsMaxAgeAndExpires(t *testing.T) {
	fixed := fixedTime()
	cb := crum.NewCookie("k", "v").WithClock(func() time.Time { return fixed })
	c, err := cb.TTL(30 * time.Minute).Build()
	assert(t, err == nil, "expecting nil got %v", err)

	assert(t, c.MaxAge > 0, "MaxAge = %d, want > 0", c.MaxAge)
	wantExp := fixed.Add(30 * time.Minute).UTC().Truncate(time.Second)
	assert(t, c.Expires.Equal(wantExp), "Expires = %v, want %v", c.Expires, wantExp)
}

func TestMaxAgeSecondsSynthesizesExpiresWhenPositive(t *testing.T) {
	fixed := fixedTime()
	c, err := crum.NewCookie("k", "v").
		WithClock(fixedTime).
		MaxAgeSeconds(90).
		Build()
	assert(t, err == nil, "expecting nil got %v", err)

	assert(t, c.MaxAge == 90, "MaxAge = %d, want 90", c.MaxAge)
	wantExp := fixed.Add(90 * time.Second).UTC().Truncate(time.Second)
	assert(t, c.Expires.Equal(wantExp), "Expires = %v, want %v", c.Expires, wantExp)
}

func TestDeleteConfiguresPastExpiresAndNegativeMaxAgeAndClearsValue(t *testing.T) {
	fixed := fixedTime()
	c, err := crum.NewCookie("sid", "secret").
		WithClock(fixedTime).
		Delete().
		Build()
	assert(t, err == nil, "expecting nil got %v", err)

	assert(t, c.MaxAge < 0, "MaxAge = %d, want negative for deletion", c.MaxAge)
	assert(t, c.Expires.Before(fixed), "Expires = %v, want before %v", c.Expires, fixed)
	assert(t, c.Value == "", "Value cleared on delete: got %q, want empty", c.Value)
}

func TestSessionClearsPersistence(t *testing.T) {
	c, err := crum.NewCookie("k", "v").TTL(time.Hour).Session().Build()
	assert(t, err == nil, "expecting nil got %v", err)
	assert(t, c.MaxAge == 0, "MaxAge = %d, want 0 after Session()", c.MaxAge)
	assert(t, c.Expires.IsZero(), "Expires = %v, want zero after Session()", c.Expires)
}

func TestSameSiteModesAndSecureConstraint(t *testing.T) {
	// Strict
	c1, err := crum.NewCookie("k", "v").SameSiteStrict().Build()
	assert(t, err == nil, "expecting nil got %v", err)
	assert(t, c1.SameSite == http.SameSiteStrictMode, "SameSite strict: got %v", c1.SameSite)

	// None forces Secure=true in the builder
	c2, err := crum.NewCookie("k", "v").SameSiteNone().Build()
	assert(t, err == nil, "expecting nil got %v", err)
	assert(t, c2.Secure, "SameSite=None must enforce Secure=true")
	assert(t, c2.SameSite == http.SameSiteNoneMode, "SameSite none: got %v", c2.SameSite)

	// If user explicitly disables Secure AFTER None, Build must error
	_, err = crum.NewCookie("k", "v").SameSiteNone().Secure(false).Build()
	assert(t, err != nil && strings.Contains(err.Error(), "SameSite=None"), "expected error for SameSite=None without Secure; got %v", err)
}

func TestSecureAndHttpOnlyToggles(t *testing.T) {
	c, err := crum.NewCookie("k", "v").
		Secure(false).
		HttpOnly(false).
		Build()
	assert(t, err == nil, "expecting nil got %v", err)
	assert(t, !c.Secure, "Secure expected false")
	assert(t, !c.HttpOnly, "HttpOnly expected false")
}

func TestInvalidNameAndValue(t *testing.T) {
	_, err := crum.NewCookie("", "v").Build()
	assert(t, err != nil && strings.Contains(err.Error(), "name must not be empty"), "expected empty name error, got %v", err)

	_, err = crum.NewCookie("bad;name", "v").Build()
	assert(t, err != nil && strings.Contains(err.Error(), "invalid characters"), "expected invalid name error, got %v", err)

	_, err = crum.NewCookie("ok", "has;semicolon").Build()
	assert(t, err != nil && strings.Contains(err.Error(), "forbidden characters"), "expected forbidden char error, got %v", err)
}

func TestMultipleErrorsAreJoined(t *testing.T) {
	// Trigger two errors: bad domain whitespace + SameSite=None with insecure
	_, err := crum.NewCookie("ok", "v").
		Domain("exa mple.com").
		SameSiteNone().
		Secure(false).
		Build()
	assert(t, err != nil, "expected joined errors")

	// We can't rely on errors.Is due to non-sentinel creation; check message contains both hints.
	msg := err.Error()
	assert(t, strings.Contains(msg, "whitespace") && strings.Contains(msg, "SameSite=None"),
		"error should contain both reasons; got: %q", msg)
}

func TestWithClock_DeterministicExpires(t *testing.T) {
	fixed := fixedTime()
	cb := crum.NewCookie("k", "v").WithClock(func() time.Time { return fixed })
	c, err := cb.TTL(1 * time.Hour).Build()
	assert(t, err == nil, "expecting nil got %v", err)

	want := fixed.Add(time.Hour).UTC().Truncate(time.Second)
	assert(t, c.Expires.Equal(want), "deterministic Expires mismatch: got %v want %v", c.Expires, want)
}

func TestMaxAgeNegativeSetsPastExpires(t *testing.T) {
	fixed := fixedTime()
	c, err := crum.NewCookie("k", "v").
		WithClock(fixedTime).
		MaxAgeSeconds(-1).
		Build()
	assert(t, err == nil, "expecting nil got %v", err)
	assert(t, c.MaxAge < 0, "MaxAge = %d, want negative", c.MaxAge)
	assert(t, c.Expires.Before(fixed), "Expires = %v, want before %v", c.Expires, fixed)
}

func TestUnsafeValue_AllowsPreEncodedButStillValidates(t *testing.T) {
	// Valid ASCII pre-encoded value
	_, err := crum.NewCookie("tok", "").UnsafeValue("YWJjMTIzXy0u~").Build()
	assert(t, err == nil, "expecting nil got %v", err)

	// Forbidden characters are still rejected
	_, err = crum.NewCookie("tok", "").UnsafeValue(`bad\value`).Build()
	assert(t, err != nil, "expected validation error for forbidden backslash")
}

func TestExpiresSetsMaxAgeIfOmitted(t *testing.T) {
	fixed := fixedTime()
	exp := fixed.Add(2 * time.Hour)
	c, err := crum.NewCookie("k", "v").
		WithClock(fixedTime).
		Expires(exp).
		Build()
	assert(t, err == nil, "expecting nil got %v", err)

	assert(t, c.Expires.Equal(exp.UTC().Truncate(time.Second)), "Expires mismatch")
	assert(t, c.MaxAge > 0, "MaxAge should be > 0 inferred from Expires, got %d", c.MaxAge)
}

// Optional: check errors.Join shape (not strictly necessary, but useful)
func TestJoinedErrorStringStableEnough(t *testing.T) {
	_, err := crum.NewCookie("", "bad;v").Secure(false).SameSiteNone().Build()
	if err == nil {
		t.Fatalf("expected error")
	}
	// At least 2+ issues should show up
	msg := err.Error()
	hints := []string{
		"name must not be empty",
		"forbidden characters",
		"SameSite=None requires Secure=true",
	}
	found := 0
	for _, h := range hints {
		if strings.Contains(msg, h) {
			found++
		}
	}
	if found < 2 {
		t.Fatalf("expected >=2 hints in joined error; got %q", msg)
	}
}

func TestFromCookie_CopiesAllFields(t *testing.T) {
	exp := time.Now().Add(24 * time.Hour).UTC().Truncate(time.Second)
	orig := &http.Cookie{
		Name:        "sid",
		Value:       "abc",
		Path:        "/x",
		Domain:      "example.com",
		Expires:     exp,
		MaxAge:      123,
		Secure:      true,
		HttpOnly:    true,
		SameSite:    http.SameSiteStrictMode,
		Partitioned: true, // will be ignored gracefully on older Go
	}

	b := crum.FromCookie(orig)
	c, err := b.Build()
	assert(t, err == nil, "expecting nil got %v", err)

	if c.Name != orig.Name ||
		c.Value != orig.Value ||
		c.Path != orig.Path ||
		c.Domain != orig.Domain ||
		c.MaxAge != orig.MaxAge ||
		c.SameSite != orig.SameSite {
		t.Fatalf("fields not copied correctly: got %+v, want %+v", c, orig)
	}

	if !c.Expires.Equal(exp) {
		t.Fatalf("Expires mismatch: %v vs %v", c.Expires, exp)
	}

	if !c.Secure || !c.HttpOnly {
		t.Fatalf("Secure/HttpOnly mismatch")
	}
}

func TestFromCookie_DeleteFlow(t *testing.T) {
	c := &http.Cookie{Name: "sid", Value: "abc"}
	newC := crum.FromCookie(c).Delete().MustBuild()

	if newC.Name != "sid" {
		t.Fatalf("Name not preserved")
	}
	if newC.Value != "" {
		t.Fatalf("Value should be cleared on delete, got %q", newC.Value)
	}
	if newC.MaxAge >= 0 {
		t.Fatalf("MaxAge should be negative on delete, got %d", newC.MaxAge)
	}
	if newC.Expires.After(time.Now()) {
		t.Fatalf("Expires should be in the past: %v", newC.Expires)
	}
}

func assert(t *testing.T, cond bool, msg string, args ...any) {
	t.Helper()
	if !cond {
		t.Fatalf(msg, args...)
	}
}