import { describe, expect, it } from 'vitest';
import { constantTimeEqual } from './auth-token.server';

describe('constantTimeEqual', () => {
  it('matches identical strings', () => {
    expect(constantTimeEqual('abc123', 'abc123')).toBe(true);
  });

  it('rejects different strings of same length', () => {
    expect(constantTimeEqual('abc123', 'abc124')).toBe(false);
  });

  it('rejects different lengths', () => {
    expect(constantTimeEqual('abc', 'abcd')).toBe(false);
  });

  it('rejects null/undefined input', () => {
    expect(constantTimeEqual(null, 'x')).toBe(false);
    expect(constantTimeEqual('x', undefined)).toBe(false);
    expect(constantTimeEqual(null, null)).toBe(false);
  });

  it('handles empty strings', () => {
    expect(constantTimeEqual('', '')).toBe(true);
    expect(constantTimeEqual('', 'x')).toBe(false);
  });

  it('handles unicode', () => {
    expect(constantTimeEqual('für', 'für')).toBe(true);
    expect(constantTimeEqual('für', 'fur')).toBe(false);
  });
});