import test from 'brittle'
import {
  signWebhookPayload,
  verifyWebhookSignature,
  isWebhookSigningEnabled,
} from '../server/services/notify.js'

test('sign and verify webhook HMAC', (t) => {
  const secret = 'test-secret'
  const ts = '1710000000000'
  const body = '{"type":"anomaly","severity":"critical"}'
  const sig = signWebhookPayload(secret, ts, body)
  t.ok(sig.startsWith('sha256='))
  t.ok(verifyWebhookSignature(secret, ts, body, sig, { now: Number(ts) }))
  t.absent(verifyWebhookSignature(secret, ts, body + 'x', sig, { now: Number(ts) }))
  t.absent(
    verifyWebhookSignature(secret, ts, body, sig, { now: Number(ts) + 10 * 60_000 })
  )
})

test('isWebhookSigningEnabled defaults on with secret', (t) => {
  const prevSecret = process.env.PEARDATA_WEBHOOK_SECRET
  const prevSign = process.env.PEARDATA_WEBHOOK_SIGN
  process.env.PEARDATA_WEBHOOK_SECRET = 'abc'
  delete process.env.PEARDATA_WEBHOOK_SIGN
  t.ok(isWebhookSigningEnabled())
  process.env.PEARDATA_WEBHOOK_SIGN = '0'
  t.absent(isWebhookSigningEnabled())
  if (prevSecret == null) delete process.env.PEARDATA_WEBHOOK_SECRET
  else process.env.PEARDATA_WEBHOOK_SECRET = prevSecret
  if (prevSign == null) delete process.env.PEARDATA_WEBHOOK_SIGN
  else process.env.PEARDATA_WEBHOOK_SIGN = prevSign
})