"""Unit tests for gateway/relay/auth.py — the gateway-side relay auth primitives.

Cross-implementation conformance: a frozen vector generated by the connector's
TypeScript (``src/core/relayAuthToken.ts`` ``makeToken``/``sign``) must be
reproduced byte-for-byte by the Python port. If the connector ever changes its
wire scheme, the vector must be regenerated in lockstep (the test fails loudly on
drift). Regenerate with:

    node -e 'import("./dist/core/relayAuthToken.js").then(m=>{ \\
      const s="00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"; \\
      console.log(m.makeToken("gw-instance-1", s, 0)); })'
"""

from __future__ import annotations

from gateway.relay.auth import make_token, make_upgrade_token

# A fixed 256-bit hex secret used for the frozen connector vector below.
_SECRET = "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"

# Frozen vector produced by the connector's TypeScript (relayAuthToken.ts).
_CONN_TOKEN = "Z3ctaW5zdGFuY2UtMTowOjM3YWE3YjE0NWU4NzY0ZDQwM2JhOWM2MzlmMjMwZGQ2M2RlOGVkOTliODhmZWQzNmFhMDI2MjVhOGE3ZTM1NjQ"


def test_upgrade_token_is_make_token_of_gateway_id():
    assert make_upgrade_token("gw-1", _SECRET, 0) == make_token("gw-1", _SECRET, 0)


def test_python_make_token_matches_connector_byte_for_byte():
    assert make_token("gw-instance-1", _SECRET, 0) == _CONN_TOKEN