// @vitest-environment node
import { describe, it, expect, beforeEach } from "vitest";
import { signApprovalToken, verifyApprovalToken } from "@/lib/auth/approval-token";

beforeEach(() => {
  process.env.APPROVAL_TOKEN_SECRET = "z".repeat(32);
});

describe("approval token", () => {
  it("round-trips an application id", async () => {
    const token = await signApprovalToken("app-123");
    const claims = await verifyApprovalToken(token);
    expect(claims.applicationId).toBe("app-123");
  });

  it("rejects a tampered token", async () => {
    const token = await signApprovalToken("app-123");
    await expect(verifyApprovalToken(token + "x")).rejects.toThrow();
  });
});
