import { test } from "node:test";
import assert from "node:assert/strict";
import { createHmac } from "node:crypto";
import { verifyTelegramInitData } from "../lib/telegram-webapp";

const token = "123:test-token";
function signedData(authDate = Math.floor(Date.now() / 1000)) {
  const params = new URLSearchParams({
    auth_date: String(authDate),
    query_id: "query",
    user: JSON.stringify({ id: 12345, username: "applicant" }),
  });
  const check = [...params.entries()].sort(([a], [b]) => a.localeCompare(b))
    .map(([key, value]) => key + "=" + value).join("\n");
  const secret = createHmac("sha256", "WebAppData").update(token).digest();
  params.set("hash", createHmac("sha256", secret).update(check).digest("hex"));
  return params.toString();
}

test("Telegram init data verifies identity and rejects tampering, duplicates, and expired data", () => {
  const data = signedData();
  assert.deepEqual(verifyTelegramInitData(data, token), { id: "12345", username: "applicant" });
  assert.equal(verifyTelegramInitData(data, "wrong-token"), null);
  assert.equal(verifyTelegramInitData(data.replace("applicant", "impostor"), token), null);
  assert.equal(verifyTelegramInitData(data + "&user=other", token), null);
  assert.equal(verifyTelegramInitData(data + "&auth_date=1", token), null);
  assert.equal(verifyTelegramInitData(data.replace(/hash=[a-f0-9]+/, "hash=not-a-hash"), token), null);
  assert.equal(verifyTelegramInitData(signedData(Math.floor(Date.now() / 1000) - 90000), token), null);
});