"""Tests for WebSocket subprotocol token extraction (daemon.server)."""

import pytest

from daemon.server import _extract_ws_token

# Realistic-looking access token (base64url header.payload.signature).
TOKEN = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.Y3WNO0CTxb4dlcVCPjUnQi"


class TestExtractWsToken:
    def test_raw_jwt_subprotocol(self):
        """Bundled client path: the JWT is sent as the subprotocol name itself."""
        assert _extract_ws_token([TOKEN]) == (TOKEN, TOKEN)

    def test_raw_jwt_among_other_subprotocols(self):
        assert _extract_ws_token(["vacuum-wall", TOKEN]) == (TOKEN, TOKEN)

    @pytest.mark.parametrize(
        "raw",
        ["none", "vacuum-wall", "a.b", "a.b.c.d"],
    )
    def test_no_auth_subprotocol(self, raw):
        assert _extract_ws_token([raw]) == (None, None)

    def test_empty_list(self):
        assert _extract_ws_token([]) == (None, None)

    def test_bearer_prefix_form(self):
        """Legacy non-browser form: 'Bearer <token>' subprotocol."""
        assert _extract_ws_token([f"Bearer {TOKEN}"]) == (TOKEN, f"Bearer {TOKEN}")

    def test_bearer_with_non_jwt_token(self):
        assert _extract_ws_token(["Bearer abc123"]) == ("abc123", "Bearer abc123")

    def test_bearer_without_token_ignored(self):
        assert _extract_ws_token(["Bearer ", "Bearer"]) == (None, None)

    def test_jwt_like_name_preferred_over_bearer(self):
        """A JWT-shaped subprotocol wins even when listed after a Bearer one."""
        result = _extract_ws_token([f"Bearer {TOKEN}", TOKEN])
        assert result == (TOKEN, TOKEN)

    def test_subprotocol_with_space_rejected(self):
        """A space is not an RFC 6455 token character — 'Bearer <token>' must
        go through the Bearer branch, never the JWT-shape branch."""
        assert _extract_ws_token(["a b.c.d"]) == (None, None)