<?php

declare(strict_types=1);

namespace Srp\Tests;

use PHPUnit\Framework\TestCase;

/**
 * Contract test for Base64URL.php — the base64url codec used for tokens on
 * the redirect hot path. Decode MUST be strict (URL-safe alphabet only) so
 * malformed tokens fail closed rather than leaking into downstream logic.
 */
final class Base64UrlTest extends TestCase
{
    public function testEncodeIsUrlSafeAndUnpadded(): void
    {
        $encoded = base64url_encode("\xff\xfe\xfd\x00");

        self::assertMatchesRegularExpression('/^[A-Za-z0-9_-]+$/', $encoded);
        self::assertStringNotContainsString('=', $encoded);
        self::assertStringNotContainsString('+', $encoded);
        self::assertStringNotContainsString('/', $encoded);
    }

    public function testRoundTripPreservesPayload(): void
    {
        $raw = 'sub_id=ABC-123_xyz&country=ID';

        self::assertSame($raw, base64url_decode(base64url_encode($raw)));
    }

    public function testDecodeRejectsNonUrlSafeAlphabet(): void
    {
        self::assertFalse(base64url_decode('not+valid/token=='));
    }

    public function testDecodeRejectsEmptyString(): void
    {
        self::assertFalse(base64url_decode(''));
    }
}
