import { describe, expect, it } from "vitest";
import { decodeCompleteCbor } from "../../src/webauthn/cbor";

describe("bounded CBOR decoder", () => {
  it("decodes deterministic maps and byte strings", () => {
    const value = decodeCompleteCbor(
      Uint8Array.from([
        0xa2, 0x01, 0x42, 0xaa, 0xbb, 0x63, 0x66, 0x6d, 0x74, 0x64, 0x6e, 0x6f,
        0x6e, 0x65,
      ]),
    );
    expect(value).toBeInstanceOf(Map);
    expect((value as Map<unknown, unknown>).get("fmt")).toBe("none");
  });

  it("rejects indefinite, duplicate and trailing encodings", () => {
    expect(() => decodeCompleteCbor(Uint8Array.from([0x9f, 0xff]))).toThrow(
      /Indefinite/iu,
    );
    expect(() =>
      decodeCompleteCbor(Uint8Array.from([0xa2, 0x01, 0x01, 0x01, 0x02])),
    ).toThrow(/duplicate/iu);
    expect(() =>
      decodeCompleteCbor(
        Uint8Array.from([0xa2, 0x41, 0xaa, 0x01, 0x41, 0xaa, 0x02]),
      ),
    ).toThrow(/duplicate/iu);
    expect(() => decodeCompleteCbor(Uint8Array.from([0x01, 0x02]))).toThrow(
      /trailing/iu,
    );
  });

  it("enforces depth and item limits", () => {
    expect(() =>
      decodeCompleteCbor(
        Uint8Array.from([...Array.from({ length: 34 }, () => 0x81), 0x00]),
      ),
    ).toThrow(/deep/iu);
  });
});