from src.domain.codegen.legacy_export_auth import sign_project_app_jwt
from src.domain.project_auth.service import _generate_rsa_key_pair
from jose import jwt


def test_export_jwt_is_rs256_staff_token_for_the_workspace_owner():
    key_id, private_pem, public_pem = _generate_rsa_key_pair()
    token = sign_project_app_jwt(
        private_pem=private_pem,
        key_id=key_id,
        project_id="296357f8-07a3-4085-b136-e9e2967b8356",
        workspace_id="5dd80e82-04a8-47f5-8fed-7e533b75de1b",
        user_id="cloud-owner",
        email="owner@example.com",
        role="super_admin",
        ttl_seconds=120,
    )
    header = jwt.get_unverified_header(token)
    payload = jwt.decode(
        token,
        public_pem,
        algorithms=["RS256"],
        options={"verify_aud": False},
    )
    assert header["alg"] == "RS256"
    assert header["kid"] == key_id
    assert payload["sub"] == "cloud-owner"
    assert payload["email"] == "owner@example.com"
    assert payload["role"] == "super_admin"
    assert payload["project_id"] == "296357f8-07a3-4085-b136-e9e2967b8356"
    assert payload["exp"] - payload["iat"] == 120