<?php

use Modules\Shared\Bnfexpress\Support\BnfexpressSignature;

test('headers computes the hex HMAC-SHA256 over METHOD\PATH\TIMESTAMP\RAW_BODY joined by newlines', function () {
    $headers = BnfexpressSignature::headers(
        method: 'post',
        path: '/admin/faqs',
        rawBody: '{"content":"hi"}',
        clientId: 'ev_admin',
        secret: 'shared-secret',
        timestamp: 1_700_000_000,
    );

    $expected = hash_hmac('sha256', "POST\n/admin/faqs\n1700000000\n{\"content\":\"hi\"}", 'shared-secret');

    expect($headers)->toBe([
        'X-Client-Id' => 'ev_admin',
        'X-Timestamp' => '1700000000',
        'X-Signature' => $expected,
    ]);
});

test('headers signs an empty raw body for a bodyless request', function () {
    $headers = BnfexpressSignature::headers(
        method: 'GET',
        path: '/admin/faqs/1',
        rawBody: '',
        clientId: 'ev_admin',
        secret: 'shared-secret',
        timestamp: 1_700_000_000,
    );

    $expected = hash_hmac('sha256', "GET\n/admin/faqs/1\n1700000000\n", 'shared-secret');

    expect($headers['X-Signature'])->toBe($expected);
});

test('headers generates a fresh timestamp per call when none is given', function () {
    $before = time();

    $headers = BnfexpressSignature::headers('GET', '/admin/faqs', '', 'ev_admin', 'secret');

    expect((int) $headers['X-Timestamp'])->toBeGreaterThanOrEqual($before)
        ->and((int) $headers['X-Timestamp'])->toBeLessThanOrEqual(time());
});