from app.platform import session

SECRET = "test-secret"


def test_sign_then_verify_round_trips():
    token = session.sign({"account_id": 7, "email": "m@example.com"}, SECRET)
    assert session.verify(token, SECRET) == {"account_id": 7, "email": "m@example.com"}


def test_verify_rejects_tampered_payload():
    token = session.sign({"account_id": 7}, SECRET)
    payload_b64, _, sig = token.partition(".")
    # Flip the payload but keep the old signature -> must be rejected.
    forged = session.sign({"account_id": 8}, SECRET).split(".")[0] + "." + sig
    assert session.verify(forged, SECRET) is None


def test_verify_rejects_wrong_secret():
    token = session.sign({"account_id": 7}, SECRET)
    assert session.verify(token, "other-secret") is None


def test_verify_rejects_garbage():
    assert session.verify("not-a-token", SECRET) is None
    assert session.verify("", SECRET) is None