"""JWT auth unit tests."""

from datetime import timedelta

import pytest
from fastapi import HTTPException

from auth import create_access_token, get_current_user


def test_token_roundtrip():
    token = create_access_token({"sub": "certauth"})
    assert get_current_user(token) == "certauth"


def test_rejects_garbage_token():
    with pytest.raises(HTTPException) as exc:
        get_current_user("not-a-jwt")
    assert exc.value.status_code == 401


def test_rejects_expired_token():
    token = create_access_token({"sub": "certauth"}, expires_delta=timedelta(minutes=-5))
    with pytest.raises(HTTPException) as exc:
        get_current_user(token)
    assert exc.value.status_code == 401


def test_rejects_token_without_subject():
    token = create_access_token({"other": "claim"})
    with pytest.raises(HTTPException):
        get_current_user(token)