"""Fase A identity fence — dual-read PinScope issuers, write Periscope only."""

from datetime import datetime, timedelta, timezone

import jwt

from backend.pinscope_compat import JWT_ISSUER, LEGACY_JWT_ISSUERS
from backend.services.local_jwt import ALGORITHM, decode_token, issue_token


def test_issue_token_uses_periscope_issuer(monkeypatch):
    from backend.config import settings

    monkeypatch.setattr(settings, "auth_jwt_secret", "unit-test-secret-32-bytes-min!!")
    token = issue_token("usr_test", "a@b.c")
    payload = jwt.decode(
        token,
        "unit-test-secret-32-bytes-min!!",
        algorithms=[ALGORITHM],
        issuer=JWT_ISSUER,
        options={"verify_aud": False},
    )
    assert payload["iss"] == JWT_ISSUER
    assert payload["iss"] not in LEGACY_JWT_ISSUERS


def test_decode_token_accepts_legacy_pinscope_issuer(monkeypatch):
    from backend.config import settings

    monkeypatch.setattr(settings, "auth_jwt_secret", "unit-test-secret-32-bytes-min!!")
    now = datetime.now(timezone.utc)
    token = jwt.encode(
        {
            "sub": "usr_legacy",
            "email": "old@b.c",
            "iss": "pinscope-local",
            "iat": now,
            "exp": now + timedelta(days=1),
        },
        "unit-test-secret-32-bytes-min!!",
        algorithm=ALGORITHM,
    )
    decoded = decode_token(token)
    assert decoded is not None
    assert decoded["sub"] == "usr_legacy"