import {test} from 'node:test';import assert from 'node:assert/strict';
// @ts-ignore server module is plain JavaScript
import {sessionCodec} from '../server/auth.mjs';
test('encrypted sessions reject tampering, expiry and other client keys',async()=>{const codec=sessionCodec('a-confidential-client-secret','character'),token=await codec.seal({sub:'alice'});assert.equal((await codec.open(token)).sub,'alice');assert.equal(await codec.open(token.slice(0,-4)+'aaaa'),null);assert.equal(await sessionCodec('another-confidential-secret','character').open(token),null);assert.equal(await codec.open(await codec.seal({sub:'alice'},-1)),null);assert.equal(await codec.open(''),null)});
test('missing secrets fail closed',()=>{assert.throws(()=>sessionCodec('','character'))});