package com.peachpasswords.passkeys

import org.junit.Assert.assertFalse
import org.junit.Assert.assertTrue
import org.junit.Test

/**
 * H-07: WebAuthn user-verification fail-closed decision. If the relying party
 * requires UV and the authenticator cannot verify the user, the assertion must
 * NOT be signed. Tests the pure decision function extracted from the activity.
 */
class PasskeyUvFailClosedTest {

    @Test fun required_and_verified_signs() {
        assertTrue(
            "UV required + user verified => sign the assertion",
            shouldSignAssertion(uvRequired = true, userVerified = true),
        )
    }

    @Test fun required_and_unverified_does_not_sign() {
        assertFalse(
            "UV required + user NOT verified => do NOT sign",
            shouldSignAssertion(uvRequired = true, userVerified = false),
        )
    }

    @Test fun not_required_and_verified_signs() {
        assertTrue(
            "UV not required + user verified => sign (UV=1 reflects ceremony)",
            shouldSignAssertion(uvRequired = false, userVerified = true),
        )
    }

    @Test fun not_required_and_unverified_signs() {
        assertTrue(
            "UV not required + user NOT verified => sign (UV=0 reflects ceremony)",
            shouldSignAssertion(uvRequired = false, userVerified = false),
        )
    }
}