package executionpool

import (
	"strings"
	"testing"
	"time"
)

func TestQueueNameDoesNotExposePoolID(t *testing.T) {
	name := QueueName("region-sensitive-name")
	if strings.Contains(name, "sensitive") || name == QueueName("other") {
		t.Fatalf("unexpected queue name %q", name)
	}
}

func TestTokenSigner(t *testing.T) {
	now := time.Unix(1000, 0)
	signer := TokenSigner{Secret: []byte("01234567890123456789012345678901"), Now: func() time.Time { return now }}
	token, err := signer.Sign(ExecutionClaims{
		Audience: "worker", TaskID: "task", PoolID: "pool", WorkerID: "worker", Nonce: "nonce", ExpiresAt: now.Add(30 * time.Second).Unix(),
	})
	if err != nil {
		t.Fatal(err)
	}
	claims, err := signer.Verify(token, "worker")
	if err != nil || claims.TaskID != "task" {
		t.Fatalf("claims=%+v err=%v", claims, err)
	}
	if _, err := signer.Verify(token, "other"); err == nil {
		t.Fatal("expected audience mismatch")
	}
}

func TestValidateAdvertisedEndpoint(t *testing.T) {
	if err := ValidateAdvertisedEndpoint("http://10.0.0.2:8088", nil, true); err != nil {
		t.Fatal(err)
	}
	if err := ValidateAdvertisedEndpoint("https://worker.internal.example", []string{"internal.example"}, false); err != nil {
		t.Fatal(err)
	}
	if err := ValidateAdvertisedEndpoint("https://public.example", []string{"internal.example"}, false); err == nil {
		t.Fatal("expected untrusted endpoint rejection")
	}
}