sz-orm-auth 5.0.0

//! Real JWT (HS256) implementation using RustCrypto audited crates.
//!
//! v0.2.2 重构（P2-5）：将手写 SHA-256 / HMAC-SHA256 / base64url 替换为
//! RustCrypto audited crate（`sha2`、`hmac`、`base64`），降低密码学实现风险。
//!
//! Token format: `base64url(header).base64url(payload).base64url(signature)`
//! where signature = HMAC-SHA256(secret, `header.payload`).

use crate::error::AuthError;
use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use base64::Engine;
use hmac::{Hmac, Mac};
use serde::{Deserialize, Serialize};
use sha2::Sha256;

/// HMAC-SHA256 类型别名（来自 RustCrypto `hmac` crate）
type HmacSha256 = Hmac<Sha256>;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct JwtHeader {
    pub alg: String,
    pub typ: String,
    #[serde(skip_serializing_if = "Option::is_none", default)]
    pub kid: Option<String>,
}

impl Default for JwtHeader {
    fn default() -> Self {
        Self {
            alg: "HS256".to_string(),
            typ: "JWT".to_string(),
            kid: None,
        }
    }
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct JwtClaims {
    pub sub: String,
    pub exp: i64,
    pub iat: i64,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub iss: Option<String>,
    #[serde(default)]
    pub roles: Vec<String>,
    #[serde(default)]
    pub permissions: Vec<String>,
    /// 用户 ID（v0.2.1 新增，修复 Critical S-2）
    ///
    /// - `Some(id)`：携带用户 ID，verify_token 可恢复正确 user.id
    /// - `None`：兼容旧 token；verify_token 会回退为 0 并通过 tracing 警告
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user_id: Option<i64>,
    /// 令牌用途（v4.8.0 新增，修复 Critical C-2 令牌类型混淆）
    ///
    /// - `Some("access")`：访问令牌
    /// - `Some("refresh")`：刷新令牌
    /// - `None`：旧版令牌（仅 verify_token 兼容；refresh_token 严格拒绝）
    ///
    /// 修复前访问/刷新令牌共用同一 claims 结构且无类型区分，黑帽审计实证：
    /// 窃取的访问令牌可送入 refresh 端点无限续期（exp 永续重置）。
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub token_use: Option<String>,
}

impl JwtClaims {
    pub fn new(sub: impl Into<String>, exp: i64) -> Self {
        Self {
            sub: sub.into(),
            exp,
            iat: current_timestamp(),
            iss: None,
            roles: Vec::new(),
            permissions: Vec::new(),
            user_id: None,
            token_use: None,
        }
    }

    pub fn with_issuer(mut self, iss: impl Into<String>) -> Self {
        self.iss = Some(iss.into());
        self
    }

    pub fn with_roles(mut self, roles: Vec<String>) -> Self {
        self.roles = roles;
        self
    }

    pub fn with_permissions(mut self, permissions: Vec<String>) -> Self {
        self.permissions = permissions;
        self
    }

    /// 设置用户 ID（v0.2.1 新增）
    pub fn with_user_id(mut self, user_id: i64) -> Self {
        self.user_id = Some(user_id);
        self
    }

    /// 设置令牌用途（v4.8.0 新增，修复 Critical C-2）：`"access"` 或 `"refresh"`
    pub fn with_token_use(mut self, token_use: &str) -> Self {
        self.token_use = Some(token_use.to_string());
        self
    }

    /// 是否为指定用途的令牌
    pub fn is_token_use(&self, token_use: &str) -> bool {
        self.token_use.as_deref() == Some(token_use)
    }

    pub fn is_expired(&self) -> bool {
        current_timestamp() > self.exp
    }
}

pub struct JwtEncoder {
    secret: String,
}

impl JwtEncoder {
    pub fn new(secret: impl Into<String>) -> Self {
        Self {
            secret: secret.into(),
        }
    }

    pub fn secret(&self) -> &str {
        &self.secret
    }

    pub fn encode(&self, claims: &JwtClaims) -> Result<String, AuthError> {
        let header = JwtHeader::default();
        let header_json = serde_json::to_string(&header)
            .map_err(|e| AuthError::TokenInvalid(format!("Header serialization failed: {}", e)))?;
        let claims_json = serde_json::to_string(claims)
            .map_err(|e| AuthError::TokenInvalid(format!("Claims serialization failed: {}", e)))?;

        let header_b64 = base64_url_encode(header_json.as_bytes());
        let claims_b64 = base64_url_encode(claims_json.as_bytes());

        let signing_input = format!("{}.{}", header_b64, claims_b64);
        let signature = hmac_sha256(self.secret.as_bytes(), signing_input.as_bytes());
        let signature_b64 = base64_url_encode(&signature);

        Ok(format!("{}.{}.{}", header_b64, claims_b64, signature_b64))
    }

    pub fn decode(&self, token: &str) -> Result<JwtClaims, AuthError> {
        if token.is_empty() {
            return Err(AuthError::TokenInvalid("Token is empty".to_string()));
        }

        let parts: Vec<&str> = token.split('.').collect();
        if parts.len() != 3 {
            return Err(AuthError::TokenInvalid(
                "Invalid JWT format: expected 3 parts".to_string(),
            ));
        }

        let header_b64 = parts[0];
        let claims_b64 = parts[1];
        let signature_b64 = parts[2];

        // Verify signature using constant-time comparison (v0.2.2 修复 H-3)。
        //
        // 原实现 `signature_b64 != expected_signature_b64` 使用 `String::ne`，
        // 该方法逐字节比较并在第一个不匹配处短路返回，导致比较时间与匹配前缀长度成正比，
        // 攻击者可通过测量响应时间逐字节恢复有效签名（时序攻击）。
        //
        // 修复：使用 `subtle::ConstantTimeEq`（RustCrypto audited crate），
        // 确保无论匹配多少字节，比较时间恒定。
        use subtle::ConstantTimeEq;
        let signing_input = format!("{}.{}", header_b64, claims_b64);
        let expected_signature = hmac_sha256(self.secret.as_bytes(), signing_input.as_bytes());
        let expected_signature_b64 = base64_url_encode(&expected_signature);

        let sig_bytes = signature_b64.as_bytes();
        let expected_bytes = expected_signature_b64.as_bytes();
        // 长度不同直接拒绝（长度信息非敏感，可短路）
        if sig_bytes.len() != expected_bytes.len() {
            return Err(AuthError::TokenInvalid("Invalid signature".to_string()));
        }
        // 常量时间比较字节数组
        let sig_match: bool = sig_bytes.ct_eq(expected_bytes).into();
        if !sig_match {
            return Err(AuthError::TokenInvalid("Invalid signature".to_string()));
        }

        // Decode header
        let header_bytes = base64_url_decode(header_b64)
            .map_err(|e| AuthError::TokenInvalid(format!("Header decode failed: {}", e)))?;
        let header: JwtHeader = serde_json::from_slice(&header_bytes)
            .map_err(|e| AuthError::TokenInvalid(format!("Header parse failed: {}", e)))?;

        if header.alg != "HS256" {
            return Err(AuthError::TokenInvalid(format!(
                "Unsupported algorithm: {}",
                header.alg
            )));
        }
        if header.typ != "JWT" {
            return Err(AuthError::TokenInvalid(format!(
                "Unsupported token type: {}",
                header.typ
            )));
        }

        // Decode claims
        let claims_bytes = base64_url_decode(claims_b64)
            .map_err(|e| AuthError::TokenInvalid(format!("Claims decode failed: {}", e)))?;
        let claims: JwtClaims = serde_json::from_slice(&claims_bytes)
            .map_err(|e| AuthError::TokenInvalid(format!("Claims parse failed: {}", e)))?;

        if claims.is_expired() {
            return Err(AuthError::TokenExpired("Token has expired".to_string()));
        }

        Ok(claims)
    }
}

fn current_timestamp() -> i64 {
    use std::time::{SystemTime, UNIX_EPOCH};
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap_or_default()
        .as_secs() as i64
}

// ============================================================================
// base64 URL-safe encoding (no padding) per RFC 4648 Section 5
//
// v0.2.2 重构（P2-5）：使用 RustCrypto audited `base64` crate 替代手写实现。
// ============================================================================

fn base64_url_encode(input: &[u8]) -> String {
    URL_SAFE_NO_PAD.encode(input)
}

fn base64_url_decode(input: &str) -> Result<Vec<u8>, String> {
    // JWT 使用 unpadded base64url，显式拒绝 `=` padding
    if input.contains('=') {
        return Err("base64url must not contain padding '='".to_string());
    }
    URL_SAFE_NO_PAD
        .decode(input)
        .map_err(|e| format!("Invalid base64url: {}", e))
}

// ============================================================================
// SHA-256 per FIPS 180-4
//
// v0.2.2 重构（P2-5）：使用 RustCrypto audited `sha2` crate 替代手写实现。
// ============================================================================

#[cfg(test)]
fn sha256(data: &[u8]) -> [u8; 32] {
    use sha2::Digest;
    let mut hasher = Sha256::new();
    hasher.update(data);
    let result = hasher.finalize();
    let mut out = [0u8; 32];
    out.copy_from_slice(&result);
    out
}

// ============================================================================
// HMAC-SHA256 per RFC 2104
//
// v0.2.2 重构（P2-5）：使用 RustCrypto audited `hmac` crate 替代手写实现。
// ============================================================================

fn hmac_sha256(key: &[u8], message: &[u8]) -> [u8; 32] {
    let mut mac = HmacSha256::new_from_slice(key).expect("HMAC accepts any key length");
    mac.update(message);
    let result = mac.finalize().into_bytes();
    let mut out = [0u8; 32];
    out.copy_from_slice(&result);
    out
}

// ============================================================================
// v3.8.0：JWT 密钥轮换（多 kid 并存，无停机轮换）
// ============================================================================

/// JWT 密钥集：支持多密钥并存，以 kid 标识，实现无停机密钥轮换
#[cfg(feature = "prod-jwt-key-rotation")]
pub struct JwtKeySet {
    keys: std::sync::RwLock<std::collections::HashMap<String, String>>,
    active_kid: std::sync::RwLock<String>,
    min_secret_length: usize,
}

#[cfg(feature = "prod-jwt-key-rotation")]
impl JwtKeySet {
    /// 创建密钥集，校验所有密钥长度 ≥ 32 字节，active_kid 存在于 keys
    pub fn new(
        keys: std::collections::HashMap<String, String>,
        active_kid: String,
    ) -> Result<Self, AuthError> {
        const MIN_LEN: usize = 32;
        for (kid, secret) in &keys {
            if secret.len() < MIN_LEN {
                return Err(AuthError::SecretTooShort(format!(
                    "key '{}' has {} bytes, minimum {} required",
                    kid,
                    secret.len(),
                    MIN_LEN
                )));
            }
        }
        if !keys.contains_key(&active_kid) {
            return Err(AuthError::TokenInvalid(format!(
                "active_kid '{}' not found in keys",
                active_kid
            )));
        }
        Ok(Self {
            keys: std::sync::RwLock::new(keys),
            active_kid: std::sync::RwLock::new(active_kid),
            min_secret_length: MIN_LEN,
        })
    }

    /// 轮换密钥：新增 kid 设为 active，保留旧 kid（旧令牌用旧密钥验证直至过期）
    pub fn rotate(&self, new_kid: String, new_secret: String) -> Result<(), AuthError> {
        if new_secret.len() < self.min_secret_length {
            return Err(AuthError::SecretTooShort(format!(
                "new key has {} bytes, minimum {} required",
                new_secret.len(),
                self.min_secret_length
            )));
        }
        {
            let mut keys = self.keys.write().unwrap();
            keys.insert(new_kid.clone(), new_secret);
        }
        let mut active = self.active_kid.write().unwrap();
        *active = new_kid;
        Ok(())
    }

    /// 移除非 active 的 kid
    pub fn remove_kid(&self, kid: &str) -> Result<(), AuthError> {
        let active = self.active_kid.read().unwrap();
        if *active == kid {
            return Err(AuthError::TokenInvalid(format!(
                "cannot remove active kid '{}'",
                kid
            )));
        }
        let mut keys = self.keys.write().unwrap();
        if keys.remove(kid).is_none() {
            return Err(AuthError::TokenInvalid(format!("kid '{}' not found", kid)));
        }
        Ok(())
    }

    /// 获取当前 active kid
    pub fn active_kid(&self) -> String {
        self.active_kid.read().unwrap().clone()
    }

    /// 按 kid 获取密钥
    pub fn get_secret(&self, kid: &str) -> Result<String, AuthError> {
        let keys = self.keys.read().unwrap();
        keys.get(kid)
            .cloned()
            .ok_or_else(|| AuthError::TokenInvalid(format!("kid '{}' not found", kid)))
    }
}

/// 带 kid 的 JWT 编解码器
#[cfg(feature = "prod-jwt-key-rotation")]
pub struct JwtEncoderWithKid {
    key_set: std::sync::Arc<JwtKeySet>,
}

#[cfg(feature = "prod-jwt-key-rotation")]
impl JwtEncoderWithKid {
    pub fn new(key_set: std::sync::Arc<JwtKeySet>) -> Self {
        Self { key_set }
    }

    /// 签发令牌：用 active_kid 密钥签发，header 携带 kid
    pub fn encode(&self, claims: &JwtClaims) -> Result<String, AuthError> {
        let kid = self.key_set.active_kid();
        let secret = self.key_set.get_secret(&kid)?;

        let header = JwtHeader {
            kid: Some(kid),
            ..Default::default()
        };
        let header_json = serde_json::to_string(&header)
            .map_err(|e| AuthError::TokenInvalid(format!("Header serialization failed: {}", e)))?;
        let claims_json = serde_json::to_string(claims)
            .map_err(|e| AuthError::TokenInvalid(format!("Claims serialization failed: {}", e)))?;

        let header_b64 = base64_url_encode(header_json.as_bytes());
        let claims_b64 = base64_url_encode(claims_json.as_bytes());
        let signing_input = format!("{}.{}", header_b64, claims_b64);
        let signature = hmac_sha256(secret.as_bytes(), signing_input.as_bytes());
        let signature_b64 = base64_url_encode(&signature);

        Ok(format!("{}.{}.{}", header_b64, claims_b64, signature_b64))
    }

    /// 验证令牌：解析 header.kid，按 kid 查找密钥验证签名
    pub fn decode(&self, token: &str) -> Result<JwtClaims, AuthError> {
        if token.is_empty() {
            return Err(AuthError::TokenInvalid("Token is empty".to_string()));
        }
        let parts: Vec<&str> = token.split('.').collect();
        if parts.len() != 3 {
            return Err(AuthError::TokenInvalid(
                "Invalid JWT format: expected 3 parts".to_string(),
            ));
        }
        let header_b64 = parts[0];
        let claims_b64 = parts[1];
        let signature_b64 = parts[2];

        let header_bytes = base64_url_decode(header_b64)
            .map_err(|e| AuthError::TokenInvalid(format!("Header decode failed: {}", e)))?;
        let header: JwtHeader = serde_json::from_slice(&header_bytes)
            .map_err(|e| AuthError::TokenInvalid(format!("Header parse failed: {}", e)))?;

        let kid = header
            .kid
            .ok_or_else(|| AuthError::TokenInvalid("missing kid in token".to_string()))?;
        let secret = self.key_set.get_secret(&kid)?;

        let signing_input = format!("{}.{}", header_b64, claims_b64);
        let expected_signature = hmac_sha256(secret.as_bytes(), signing_input.as_bytes());
        let expected_b64 = base64_url_encode(&expected_signature);

        use subtle::ConstantTimeEq;
        if signature_b64
            .as_bytes()
            .ct_eq(expected_b64.as_bytes())
            .into()
        {
            let claims_bytes = base64_url_decode(claims_b64)
                .map_err(|e| AuthError::TokenInvalid(format!("Claims decode failed: {}", e)))?;
            let claims: JwtClaims = serde_json::from_slice(&claims_bytes)
                .map_err(|e| AuthError::TokenInvalid(format!("Claims parse failed: {}", e)))?;
            if claims.is_expired() {
                return Err(AuthError::TokenExpired("token expired".to_string()));
            }
            Ok(claims)
        } else {
            Err(AuthError::TokenInvalid(
                "Signature verification failed".to_string(),
            ))
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn now() -> i64 {
        current_timestamp()
    }

    // SHA-256 known answer tests (FIPS 180-2 examples)

    #[test]
    fn test_sha256_empty() {
        // sha256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        let hash = sha256(b"");
        let expected_hex = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
        assert_eq!(hex_str(&hash), expected_hex);
    }

    #[test]
    fn test_sha256_abc() {
        // sha256("abc") = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
        let hash = sha256(b"abc");
        let expected_hex = "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad";
        assert_eq!(hex_str(&hash), expected_hex);
    }

    #[test]
    fn test_sha256_longer_message() {
        // sha256("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq")
        let input = b"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
        let hash = sha256(input);
        let expected_hex = "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1";
        assert_eq!(hex_str(&hash), expected_hex);
    }

    // HMAC-SHA256 known answer test (RFC 4231 Test Case 1)

    #[test]
    fn test_hmac_sha256_rfc4231_case1() {
        // Key = 0x0b repeated 20 times, Data = "Hi There"
        let key = [0x0bu8; 20];
        let message = b"Hi There";
        let mac = hmac_sha256(&key, message);
        let expected_hex = "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7";
        assert_eq!(hex_str(&mac), expected_hex);
    }

    #[test]
    fn test_hmac_sha256_rfc4231_case2() {
        // Key = "Jefe", Data = "what do ya want for nothing?"
        let mac = hmac_sha256(b"Jefe", b"what do ya want for nothing?");
        let expected_hex = "5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843";
        assert_eq!(hex_str(&mac), expected_hex);
    }

    #[test]
    fn test_hmac_sha256_long_key() {
        // Key longer than 64 bytes should be hashed first (RFC 4231 Case 6 uses 131 bytes)
        let key = [0xaau8; 131];
        let data = b"Test Using Larger Than Block-Size Key - Hash Key First";
        let mac = hmac_sha256(&key, data);
        let expected_hex = "60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54";
        assert_eq!(hex_str(&mac), expected_hex);
    }

    // base64url tests

    #[test]
    fn test_base64_url_encode_known() {
        // RFC 4648 Section 10 (with URL alphabet, no padding):
        // "" -> "", "f" -> "Zg", "fo" -> "Zm8", "foo" -> "Zm9v",
        // "foob" -> "Zm9vYg", "fooba" -> "Zm9vYmE", "foobar" -> "Zm9vYmFy"
        assert_eq!(base64_url_encode(b""), "");
        assert_eq!(base64_url_encode(b"f"), "Zg");
        assert_eq!(base64_url_encode(b"fo"), "Zm8");
        assert_eq!(base64_url_encode(b"foo"), "Zm9v");
        assert_eq!(base64_url_encode(b"foob"), "Zm9vYg");
        assert_eq!(base64_url_encode(b"fooba"), "Zm9vYmE");
        assert_eq!(base64_url_encode(b"foobar"), "Zm9vYmFy");
    }

    #[test]
    fn test_base64_url_decode_known() {
        assert_eq!(base64_url_decode("").unwrap(), b"");
        assert_eq!(base64_url_decode("Zg").unwrap(), b"f");
        assert_eq!(base64_url_decode("Zm8").unwrap(), b"fo");
        assert_eq!(base64_url_decode("Zm9v").unwrap(), b"foo");
        assert_eq!(base64_url_decode("Zm9vYg").unwrap(), b"foob");
        assert_eq!(base64_url_decode("Zm9vYmE").unwrap(), b"fooba");
        assert_eq!(base64_url_decode("Zm9vYmFy").unwrap(), b"foobar");
    }

    #[test]
    fn test_base64_url_roundtrip() {
        let cases: &[&[u8]] = &[
            b"",
            b"a",
            b"ab",
            b"abc",
            b"abcd",
            b"hello world",
            &[0xffu8; 64],
            &[0x00u8; 64],
            &(0u8..=255).collect::<Vec<u8>>(),
        ];
        for c in cases {
            let encoded = base64_url_encode(c);
            let decoded = base64_url_decode(&encoded).unwrap();
            assert_eq!(decoded.as_slice(), *c, "roundtrip failed for {:?}", c);
        }
    }

    #[test]
    fn test_base64_url_rejects_padding() {
        assert!(base64_url_decode("Zg==").is_err());
    }

    #[test]
    fn test_base64_url_rejects_invalid_char() {
        assert!(base64_url_decode("Zm9v*").is_err());
    }

    // JWT encode/decode tests

    #[test]
    fn test_jwt_encode_decode_roundtrip() {
        let encoder = JwtEncoder::new("my-secret");
        let claims = JwtClaims::new("user123", now() + 3600)
            .with_issuer("test-issuer")
            .with_roles(vec!["user".to_string(), "editor".to_string()])
            .with_permissions(vec!["read:posts".to_string(), "write:posts".to_string()]);

        let token = encoder.encode(&claims).expect("encode");
        assert!(!token.is_empty());

        let parts: Vec<&str> = token.split('.').collect();
        assert_eq!(parts.len(), 3);

        let decoded = encoder.decode(&token).expect("decode");
        assert_eq!(decoded.sub, "user123");
        assert_eq!(decoded.iss, Some("test-issuer".to_string()));
        assert_eq!(
            decoded.roles,
            vec!["user".to_string(), "editor".to_string()]
        );
        assert_eq!(
            decoded.permissions,
            vec!["read:posts".to_string(), "write:posts".to_string()]
        );
    }

    #[test]
    fn test_jwt_format_is_header_payload_signature() {
        let encoder = JwtEncoder::new("secret");
        let claims = JwtClaims::new("alice", now() + 60);
        let token = encoder.encode(&claims).unwrap();
        let parts: Vec<&str> = token.split('.').collect();
        assert_eq!(parts.len(), 3);

        // Header should decode to {"alg":"HS256","typ":"JWT"}
        let header_bytes = base64_url_decode(parts[0]).unwrap();
        let header: JwtHeader = serde_json::from_slice(&header_bytes).unwrap();
        assert_eq!(header.alg, "HS256");
        assert_eq!(header.typ, "JWT");
    }

    #[test]
    fn test_jwt_signature_changes_with_secret() {
        let encoder_a = JwtEncoder::new("secret-a");
        let encoder_b = JwtEncoder::new("secret-b");
        let claims = JwtClaims::new("user", now() + 3600);

        let token_a = encoder_a.encode(&claims).unwrap();
        let token_b = encoder_b.encode(&claims).unwrap();

        // Header.payload should be the same, but signature differs.
        let parts_a: Vec<&str> = token_a.split('.').collect();
        let parts_b: Vec<&str> = token_b.split('.').collect();
        assert_eq!(parts_a[0], parts_b[0]); // header
        assert_eq!(parts_a[1], parts_b[1]); // payload
        assert_ne!(parts_a[2], parts_b[2]); // signature
    }

    #[test]
    fn test_jwt_verify_with_wrong_secret_fails() {
        let encoder_a = JwtEncoder::new("secret-a");
        let encoder_b = JwtEncoder::new("secret-b");
        let claims = JwtClaims::new("user", now() + 3600);

        let token = encoder_a.encode(&claims).unwrap();
        let result = encoder_b.decode(&token);
        assert!(matches!(result, Err(AuthError::TokenInvalid(_))));
    }

    #[test]
    fn test_jwt_expired_token_rejected() {
        let encoder = JwtEncoder::new("secret");
        let claims = JwtClaims::new("user", now() - 100); // expired 100s ago
        let token = encoder.encode(&claims).unwrap();
        let result = encoder.decode(&token);
        assert!(matches!(result, Err(AuthError::TokenExpired(_))));
    }

    #[test]
    fn test_jwt_decode_invalid_format() {
        let encoder = JwtEncoder::new("secret");
        assert!(matches!(
            encoder.decode(""),
            Err(AuthError::TokenInvalid(_))
        ));
        assert!(matches!(
            encoder.decode("not.a.jwt.token"),
            Err(AuthError::TokenInvalid(_))
        ));
        assert!(matches!(
            encoder.decode("only.two"),
            Err(AuthError::TokenInvalid(_))
        ));
    }

    #[test]
    fn test_jwt_tampered_payload_rejected() {
        let encoder = JwtEncoder::new("secret");
        let claims = JwtClaims::new("alice", now() + 3600);
        let token = encoder.encode(&claims).unwrap();

        // Tamper with the payload by replacing it with a different valid base64url string.
        let parts: Vec<&str> = token.split('.').collect();
        let tampered_payload = base64_url_encode(
            br#"{"sub":"mallory","exp":9999999999,"iat":0,"roles":[],"permissions":[]}"#,
        );
        let tampered = format!("{}.{}.{}", parts[0], tampered_payload, parts[2]);
        let result = encoder.decode(&tampered);
        assert!(matches!(result, Err(AuthError::TokenInvalid(_))));
    }

    #[test]
    fn test_jwt_tampered_signature_rejected() {
        let encoder = JwtEncoder::new("secret");
        let claims = JwtClaims::new("alice", now() + 3600);
        let token = encoder.encode(&claims).unwrap();

        let parts: Vec<&str> = token.split('.').collect();
        // Flip the first character of the signature
        let mut sig = parts[2].to_string();
        let first = sig.chars().next().unwrap();
        let replacement = if first == 'A' { 'B' } else { 'A' };
        sig.replace_range(0..first.len_utf8(), &replacement.to_string());
        let tampered = format!("{}.{}.{}", parts[0], parts[1], sig);
        let result = encoder.decode(&tampered);
        assert!(matches!(result, Err(AuthError::TokenInvalid(_))));
    }

    fn hex_str(bytes: &[u8]) -> String {
        let mut s = String::with_capacity(bytes.len() * 2);
        for b in bytes {
            s.push_str(&format!("{:02x}", b));
        }
        s
    }

    #[cfg(feature = "prod-jwt-key-rotation")]
    mod prod_jwt_key_rotation_tests {
        use super::*;
        use std::collections::HashMap;

        fn make_secret(n: usize) -> String {
            "a".repeat(n)
        }

        #[test]
        fn test_key_set_new_validates_min_length() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(32));
            let result = JwtKeySet::new(keys, "kid1".to_string());
            assert!(result.is_ok());
        }

        #[test]
        fn test_key_set_new_rejects_short_secret() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(31));
            let result = JwtKeySet::new(keys, "kid1".to_string());
            assert!(result.is_err());
        }

        #[test]
        fn test_key_set_new_rejects_missing_active_kid() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(32));
            let result = JwtKeySet::new(keys, "kid2".to_string());
            assert!(result.is_err());
        }

        #[test]
        fn test_encode_decode_with_kid() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(32));
            keys.insert("kid2".to_string(), make_secret(32));
            let key_set = JwtKeySet::new(keys, "kid2".to_string()).unwrap();
            let encoder = JwtEncoderWithKid::new(std::sync::Arc::new(key_set));

            let claims = JwtClaims::new("alice", current_timestamp() + 3600);
            let token = encoder.encode(&claims).unwrap();
            let decoded = encoder.decode(&token).unwrap();
            assert_eq!(decoded.sub, "alice");
        }

        #[test]
        fn test_rotate_old_token_still_valid() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(32));
            let key_set = std::sync::Arc::new(JwtKeySet::new(keys, "kid1".to_string()).unwrap());
            let encoder = JwtEncoderWithKid::new(key_set.clone());

            let claims = JwtClaims::new("bob", current_timestamp() + 3600);
            let old_token = encoder.encode(&claims).unwrap();

            key_set.rotate("kid2".to_string(), make_secret(32)).unwrap();
            let new_token = encoder.encode(&claims).unwrap();

            assert!(encoder.decode(&old_token).is_ok());
            assert!(encoder.decode(&new_token).is_ok());
        }

        #[test]
        fn test_remove_kid_rejects_active() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(32));
            keys.insert("kid2".to_string(), make_secret(32));
            let key_set = JwtKeySet::new(keys, "kid1".to_string()).unwrap();
            assert!(key_set.remove_kid("kid1").is_err());
            assert!(key_set.remove_kid("kid2").is_ok());
        }

        #[test]
        fn test_decode_missing_kid_rejected() {
            let mut keys = HashMap::new();
            keys.insert("kid1".to_string(), make_secret(32));
            let key_set = JwtKeySet::new(keys, "kid1".to_string()).unwrap();
            let encoder = JwtEncoderWithKid::new(std::sync::Arc::new(key_set));

            let plain_encoder = JwtEncoder::new(make_secret(32));
            let claims = JwtClaims::new("eve", current_timestamp() + 3600);
            let token = plain_encoder.encode(&claims).unwrap();

            assert!(encoder.decode(&token).is_err());
        }
    }
}