/*
catcrafts.net
Copyright (C) 2026 Catcrafts

The source code of this website is made available for viewing purposes only.
No permission is granted to copy, modify, distribute, or create derivative works.
*/

// Order tokens and the human-facing references derived from them. The token
// is the only credential an order page has, so its shape check is a security
// boundary: anything that is not exactly 32 lowercase hex characters must
// never reach a lookup.

import std;
import Catcrafts.Shared;
import Catcrafts.Server;

using namespace Catcrafts;

namespace {

int failures = 0;

void Check(bool ok, std::string_view what, std::string_view got = {}) {
    if (ok) return;
    ++failures;
    std::println(std::cerr, "FAIL: {}{}{}", what,
                 got.empty() ? "" : "  got: ", got);
}

} // namespace

int main() {
    Check(IsOrderToken("0123456789abcdef0123456789abcdef"), "token: valid shape");
    Check(!IsOrderToken("0123456789ABCDEF0123456789ABCDEF"), "token: uppercase rejected");
    Check(!IsOrderToken("0123456789abcdef0123456789abcde"), "token: short rejected");
    Check(!IsOrderToken("0123456789abcdef0123456789abcdeg"), "token: non-hex rejected");
    const std::string tok = Server::NewOrderToken();
    Check(IsOrderToken(tok), "token: generator emits valid tokens", tok);
    Check(Server::NewOrderToken() != tok, "token: not constant");
    Check(Server::ReferenceFromToken("abcdef0123456789abcdef0123456789") == "CC-ABCDEF",
          "reference: derived and uppercased");

    if (failures != 0) {
        std::println(std::cerr, "{} check(s) failed", failures);
        return 1;
    }
    return 0;
}