chai      = require 'chai'
sinon     = require 'sinon'
sinonChai = require 'sinon-chai'
expect    = chai.expect




chai.use sinonChai
chai.should()




ClientToken = require '../../../models/ClientToken'
verifyClientToken = require('../../../oidc').verifyClientToken




describe 'Verify Client Token', ->


  {req,res,next,err} = {}


  describe 'with missing bearer token', ->

    before (done) ->
      req  = headers: {}
      res  = {}
      next = sinon.spy()

      verifyClientToken req, res, (error) ->
        err = error
        done()

    it 'should provide an UnauthorizedError', ->
      err.name.should.equal 'UnauthorizedError'

    it 'should provide a realm', ->
      err.realm.should.equal 'client'

    it 'should provide an error code', ->
      err.error.should.equal 'unauthorized_client'

    it 'should provide an error description', ->
      err.error_description.should.equal 'Missing authorization header'

    it 'should provide a status code', ->
      err.statusCode.should.equal 403




  describe 'with valid token', ->

    token = null

    before (done) ->
      token =
        header: {}
        payload: {}

      sinon.stub(ClientToken, 'decode').returns token

      req  = headers: { authorization: 'Bearer valid.signed.jwt' }
      res  = {}
      next = sinon.spy (error) ->
        err = error
        done()

      verifyClientToken req, res, next

    after ->
      ClientToken.decode.restore()

    it 'should reference the retrieved token object', ->
      req.token.should.equal token

    it 'should continue', ->
      next.should.have.been.called




  describe 'with invalid token', ->

    before (done) ->
      req  = headers: { authorization: 'Bearer invalid' }
      res  = {}
      next = sinon.spy()

      verifyClientToken req, res, (error) ->
        err = error
        done()

    it 'should provide an UnauthorizedError', ->
      err.name.should.equal 'UnauthorizedError'

    it 'should provide a realm', ->
      err.realm.should.equal 'client'

    it 'should provide an error code', ->
      err.error.should.equal 'unauthorized_client'

    it 'should provide an error description', ->
      err.error_description.should.equal 'Invalid access token'

    it 'should provide a status code', ->
      err.statusCode.should.equal 403