package com.zioinfo.kintex.security;

import org.junit.jupiter.api.Test;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertTrue;

/**
 * OTP 시크릿 봉인/해제(AES-256-GCM) 왕복·하위호환 단위테스트.
 */
class SecretCipherTest {

    private SecretCipher newCipher() {
        // encKey 미주입 → 개발 파생키 사용(테스트 결정적).
        return new SecretCipher(new SecurityPolicyProperties());
    }

    @Test
    void sealThenOpenRoundTrips() {
        SecretCipher cipher = newCipher();
        String secret = "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP";
        String sealed = cipher.seal(secret);
        assertTrue(sealed.startsWith("enc:v1:"), "봉인 접두어");
        org.junit.jupiter.api.Assertions.assertNotEquals(secret, sealed, "저장값은 평문과 달라야 함");
        assertEquals(secret, cipher.open(sealed), "복호화 왕복 일치");
    }

    @Test
    void openTreatsUnprefixedAsPlaintext() {
        SecretCipher cipher = newCipher();
        // 이관 이전 평문 시크릿은 그대로 반환(하위호환).
        assertEquals("PLAINSECRET", cipher.open("PLAINSECRET"));
    }

    @Test
    void handlesNullAndBlank() {
        SecretCipher cipher = newCipher();
        assertNull(cipher.seal(null));
        assertNull(cipher.open(null));
        assertEquals("", cipher.seal(""));
    }
}
