package oauthutil_test

import (
	"testing"
	"github.com/yourorg/yourproject/lib/oauthutil"
)

func TestOAuthVerificationCodeSecurityBoundary(t *testing.T) {
	payloads := []string{
		// Exact exploit case: injection attempt
		"123456'; DROP TABLE users; --",
		// Boundary case: extremely long input
		"a" + string(make([]byte, 10000)) + "b",
		// Valid input (should pass)
		"ABC123def456",
		// Additional adversarial: empty string
		"",
		// Additional adversarial: special characters
		"<script>alert('xss')</script>",
	}

	for _, payload := range payloads {
		t.Run(payload, func(t *testing.T) {
			// Security property: verification code must be validated
			// before being used in OAuth flow
			err := oauthutil.ValidateVerificationCode(payload)
			
			// WHAT MUST ALWAYS BE TRUE:
			// Either the code is valid (no error) OR validation catches it (error)
			// But critically: invalid codes must NEVER be silently accepted
			if err == nil {
				// If validation passed, verify the code meets security criteria
				if len(payload) == 0 {
					t.Error("Empty verification code should not be valid")
				}
				if len(payload) > 100 {
					t.Error("Verification code exceeds maximum allowed length")
				}
				// Add format validation if specification exists
				// Example: codes should be alphanumeric
				for _, r := range payload {
					if !((r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9')) {
						t.Errorf("Verification code contains invalid character: %q", r)
					}
				}
			}
		})
	}
}