// JWT factory for seam tests. Hand-rolls an HS256-shaped token with a
// base64url-encoded payload that matches the shape decodeJwt() in
// stores/auth.js expects. jsdom provides btoa/atob natively.
//
// Usage:
//   const tok = makeJwt()                        // valid 1h token
//   const exp = expiredJwt()                     // exp 10s ago
//   const soon = expiringSoonJwt(30)             // exp 30s from now

const now = () => Math.floor(Date.now() / 1000)

const base64UrlEncode = (str) =>
  btoa(str).replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_')

export const makeJwt = (claims = {}) => {
  const payload = {
    iat: now(),
    sub: 'test-user',
    exp: now() + 3600,
    ...claims,
  }
  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))
  const body = base64UrlEncode(JSON.stringify(payload))
  return `${header}.${body}.sig`
}

export const expiredJwt = (offsetSeconds = -10) =>
  makeJwt({ exp: now() + offsetSeconds })

export const expiringSoonJwt = (thresholdSeconds = 30) =>
  makeJwt({ exp: now() + thresholdSeconds })