package wristband

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"net/url"
	"strings"
	"testing"
	"time"
)

const tokenTestRedirect = "https://chatgpt.com/connector/oauth/cb"

// insertTokenTestClient inserts an already-usable ClientRecord directly into
// backend (bypassing CreateWithCap's cap/sweep policy, which this plan's
// tests do not exercise) and returns it.
func insertTokenTestClient(backend *memoryBackend, clientID, authMethod string, secretHash *string, ceiling []string) *ClientRecord {
	backend.mu.Lock()
	defer backend.mu.Unlock()
	backend.nextID++
	rec := &ClientRecord{
		ID:                      backend.nextID,
		ClientID:                clientID,
		ClientSecretHash:        secretHash,
		ClientName:              "Test Client",
		RedirectURIs:            []string{tokenTestRedirect},
		GrantTypes:              []string{"authorization_code", "refresh_token"},
		TokenEndpointAuthMethod: authMethod,
		ScopeCeiling:            ceiling,
		CreatedAt:               time.Now(),
	}
	backend.clients = append(backend.clients, rec)
	return rec
}

// insertTokenTestCode seeds an already-issued (post-consent) code row
// directly into backend, matching the shape 08-05's consent flow will
// produce via AuthCodeStore.MarkIssued: CodeHash set, RequestID nil, UserID
// set. mutate, when non-nil, is applied to the record before it is stored so
// individual tests can adjust ExpiresAt/UsedAt/ClientID/etc.
func insertTokenTestCode(t *testing.T, backend *memoryBackend, clientID string, challenge string, mutate func(*AuthCodeRecord)) (rawCode string, rec *AuthCodeRecord) {
	t.Helper()
	raw, err := randomBase64URL(32)
	if err != nil {
		t.Fatal(err)
	}
	backend.mu.Lock()
	defer backend.mu.Unlock()
	backend.nextID++
	userID := uint(1)
	hash := sha256Hex(raw)
	rec = &AuthCodeRecord{
		ID:                  backend.nextID,
		CodeHash:            &hash,
		ClientID:            clientID,
		UserID:              &userID,
		RedirectURI:         tokenTestRedirect,
		Scopes:              []string{"read", "write"},
		CodeChallenge:       challenge,
		CodeChallengeMethod: "S256",
		ExpiresAt:           time.Now().Add(5 * time.Minute),
	}
	if mutate != nil {
		mutate(rec)
	}
	backend.codes = append(backend.codes, rec)
	return raw, rec
}

// tokenRequest builds a POST /oauth/mcp/token request from form (encoded as
// the body) with an optional Authorization header, matching the D-02 body
// parser every test in this file exercises.
func tokenRequest(form url.Values, contentType string) *http.Request {
	if contentType == "" {
		contentType = "application/x-www-form-urlencoded"
	}
	req := httptest.NewRequest(http.MethodPost, "/oauth/mcp/token", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", contentType)
	return req
}

// TestPhase8RedCodeExchange is the Phase 8 Wave 4 RED anchor (08-04-PLAN.md
// Task 1, D-02/D-04/D-05/D-07). It drives one valid S256 authorization-code
// exchange through the real (in-memory-backed) Server.Token and asserts the
// exact RFC 6749 success contract. It fails with the
// PHASE8_RED:code-exchange sentinel while Token is the 501 stub;
// scripts/check-phase8-red.sh verifies this failure is fail-closed.
func TestPhase8RedCodeExchange(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	insertTokenTestClient(backend, "cli-red", "none", nil, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-red", challenge, nil)

	req := tokenRequest(url.Values{
		"grant_type":    {"authorization_code"},
		"code":          {rawCode},
		"code_verifier": {verifier},
		"redirect_uri":  {tokenTestRedirect},
		"client_id":     {"cli-red"},
	}, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("PHASE8_RED:code-exchange: status = %d, want %d (body=%s)", rec.Code, http.StatusOK, rec.Body.String())
	}
	var got map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
		t.Fatalf("PHASE8_RED:code-exchange: decode response: %v", err)
	}
	access, _ := got["access_token"].(string)
	refresh, _ := got["refresh_token"].(string)
	if access == "" || refresh == "" {
		t.Fatalf("PHASE8_RED:code-exchange: access_token/refresh_token empty in %v", got)
	}
	if got["token_type"] != "Bearer" {
		t.Fatalf("PHASE8_RED:code-exchange: token_type = %v, want Bearer", got["token_type"])
	}
	if got["scope"] != "read write" {
		t.Fatalf("PHASE8_RED:code-exchange: scope = %v, want %q", got["scope"], "read write")
	}
	if cc := rec.Header().Get("Cache-Control"); cc != "no-store" {
		t.Fatalf("PHASE8_RED:code-exchange: Cache-Control = %q, want \"no-store\"", cc)
	}
}

// assertTokenError decodes rec as the exact PHP token error body ({"error":
// code}, no error_description) and asserts status/code.
func assertTokenError(t *testing.T, rec *httptest.ResponseRecorder, status int, code string) map[string]any {
	t.Helper()
	if rec.Code != status {
		t.Fatalf("status = %d, want %d (body=%s)", rec.Code, status, rec.Body.String())
	}
	var got map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
		t.Fatalf("decode error body: %v (body=%s)", err, rec.Body.String())
	}
	if got["error"] != code {
		t.Fatalf("error = %v, want %q", got["error"], code)
	}
	if _, has := got["error_description"]; has {
		t.Fatalf("body = %s carries error_description, PHP token errors never do", rec.Body.String())
	}
	return got
}

// newTokenExchangeFixture seeds one usable public client and one valid
// pending-issued code bound to it, returning everything a caller needs to
// build a successful exchange request (and to mutate before breaking it).
func newTokenExchangeFixture(t *testing.T) (srv *Server, backend *memoryBackend, verifier string, rawCode string, code *AuthCodeRecord) {
	t.Helper()
	backend = newMemoryBackend()
	srv = newTestServer(backend)
	insertTokenTestClient(backend, "cli-tok", "none", nil, nil)
	var challenge string
	verifier, challenge = s256Pair(t)
	rawCode, code = insertTokenTestCode(t, backend, "cli-tok", challenge, nil)
	return
}

func validExchangeForm(rawCode, verifier, clientID string) url.Values {
	return url.Values{
		"grant_type":    {"authorization_code"},
		"code":          {rawCode},
		"code_verifier": {verifier},
		"redirect_uri":  {tokenTestRedirect},
		"client_id":     {clientID},
	}
}

// TestTokenRejectsJSONBodyEvenWithValidQueryParams proves D-02/Pitfall 4: a
// JSON content type is rejected before ParseForm ever runs, so a valid
// grant cannot be smuggled through the query string of a JSON-labeled
// request.
func TestTokenRejectsJSONBodyEvenWithValidQueryParams(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)

	q := validExchangeForm(rawCode, verifier, "cli-tok")
	req := httptest.NewRequest(http.MethodPost, "/oauth/mcp/token?"+q.Encode(), strings.NewReader(`{"grant_type":"authorization_code"}`))
	req.Header.Set("Content-Type", "application/json")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	assertTokenError(t, rec, http.StatusBadRequest, "invalid_request")
}

// TestTokenBodyOverQueryPrecedence proves D-02: when the same key appears in
// both the form body and the query string, the body value wins (matching
// net/http's own documented ParseForm precedence, verified against the
// stdlib source for this plan).
func TestTokenBodyOverQueryPrecedence(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)

	form := validExchangeForm(rawCode, verifier, "cli-tok")
	req := httptest.NewRequest(http.MethodPost, "/oauth/mcp/token?grant_type=refresh_token", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want %d (body=%s): body grant_type must win over query grant_type", rec.Code, http.StatusOK, rec.Body.String())
	}
}

// TestTokenBasicCredentialsOverrideFormCredentials proves the confidential
// client's Basic header wins over (wrong) form client_id/client_secret
// values.
func TestTokenBasicCredentialsOverrideFormCredentials(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	hash := sha256Hex("correct-secret")
	insertTokenTestClient(backend, "cli-basic", "client_secret_basic", &hash, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-basic", challenge, nil)

	form := url.Values{
		"grant_type":    {"authorization_code"},
		"code":          {rawCode},
		"code_verifier": {verifier},
		"redirect_uri":  {tokenTestRedirect},
		"client_id":     {"cli-basic"},
		"client_secret": {"wrong-form-secret"},
	}
	req := tokenRequest(form, "")
	req.SetBasicAuth("cli-basic", "correct-secret")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want %d (body=%s): Basic header must override form client_secret", rec.Code, http.StatusOK, rec.Body.String())
	}
}

func TestTokenMissingGrantTypeIsInvalidRequest(t *testing.T) {
	srv, _, _, _, _ := newTokenExchangeFixture(t)
	req := tokenRequest(url.Values{}, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_request")
}

func TestTokenUnsupportedGrantTypeIsRejected(t *testing.T) {
	srv, _, _, _, _ := newTokenExchangeFixture(t)
	req := tokenRequest(url.Values{"grant_type": {"client_credentials"}}, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "unsupported_grant_type")
}

func TestTokenUnknownClientIsInvalidClientWithBasicChallenge(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
	form := validExchangeForm(rawCode, verifier, "does-not-exist")
	req := tokenRequest(form, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	assertTokenError(t, rec, http.StatusUnauthorized, "invalid_client")
	if wa := rec.Header().Get("WWW-Authenticate"); wa != `Basic realm="OAuth"` {
		t.Fatalf("WWW-Authenticate = %q, want %q", wa, `Basic realm="OAuth"`)
	}
}

func TestTokenRevokedClientIsInvalidClient(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	client := insertTokenTestClient(backend, "cli-revoked", "none", nil, nil)
	now := time.Now()
	client.RevokedAt = &now
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-revoked", challenge, nil)

	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-revoked"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusUnauthorized, "invalid_client")
}

func TestTokenConfidentialClientMissingSecretIsInvalidClient(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	hash := sha256Hex("s3cret")
	insertTokenTestClient(backend, "cli-conf-missing", "client_secret_post", &hash, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-conf-missing", challenge, nil)

	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-conf-missing"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusUnauthorized, "invalid_client")
	if wa := rec.Header().Get("WWW-Authenticate"); wa != `Basic realm="OAuth"` {
		t.Fatalf("WWW-Authenticate = %q, want %q", wa, `Basic realm="OAuth"`)
	}
}

// TestTokenConfidentialClientWrongSecretIsInvalidClient is the plan's named
// "invalid confidential client" case: exact status/body/no-newline,
// Cache-Control absent (only success responses carry it), and the Basic
// realm="OAuth" challenge (T-08-SECRET-TIMING: comparison goes through
// constantEqual/sha256Hex, never a direct string compare).
func TestTokenConfidentialClientWrongSecretIsInvalidClient(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	hash := sha256Hex("correct-secret")
	insertTokenTestClient(backend, "cli-conf-wrong", "client_secret_post", &hash, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-conf-wrong", challenge, nil)

	form := validExchangeForm(rawCode, verifier, "cli-conf-wrong")
	form.Set("client_secret", "wrong-secret")
	req := tokenRequest(form, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusUnauthorized)
	}
	if body := rec.Body.String(); body != `{"error":"invalid_client"}` {
		t.Fatalf("body = %q, want exact %q", body, `{"error":"invalid_client"}`)
	}
	if strings.HasSuffix(rec.Body.String(), "\n") {
		t.Fatal("body has a trailing newline")
	}
	if wa := rec.Header().Get("WWW-Authenticate"); wa != `Basic realm="OAuth"` {
		t.Fatalf("WWW-Authenticate = %q, want %q", wa, `Basic realm="OAuth"`)
	}
	if cc := rec.Header().Get("Cache-Control"); cc != "" {
		t.Fatalf("Cache-Control = %q, want none on an error response", cc)
	}
}

func TestTokenPublicClientIgnoresSuppliedSecret(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
	form := validExchangeForm(rawCode, verifier, "cli-tok")
	form.Set("client_secret", "irrelevant-for-a-public-client")
	req := tokenRequest(form, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want %d (body=%s)", rec.Code, http.StatusOK, rec.Body.String())
	}
}

func TestTokenWrongVerifierIsInvalidGrant(t *testing.T) {
	srv, backend, _, rawCode, _ := newTokenExchangeFixture(t)
	form := validExchangeForm(rawCode, "wrong-verifier-entirely", "cli-tok")
	req := tokenRequest(form, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")

	backend.mu.Lock()
	defer backend.mu.Unlock()
	if len(backend.tokens) != 0 {
		t.Fatal("a wrong-verifier exchange must not mint an access token")
	}
}

func TestTokenClientMismatchIsInvalidGrant(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	insertTokenTestClient(backend, "cli-owner", "none", nil, nil)
	insertTokenTestClient(backend, "cli-other", "none", nil, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-owner", challenge, nil)

	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-other"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")
}

func TestTokenRedirectURIMismatchIsInvalidGrant(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
	form := validExchangeForm(rawCode, verifier, "cli-tok")
	form.Set("redirect_uri", "https://evil.example.test/cb")
	req := tokenRequest(form, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")
}

func TestTokenResourceMismatchIsInvalidGrant(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	insertTokenTestClient(backend, "cli-res", "none", nil, nil)
	verifier, challenge := s256Pair(t)
	res := "https://mcp.plytarium.com/mcp"
	rawCode, _ := insertTokenTestCode(t, backend, "cli-res", challenge, func(rec *AuthCodeRecord) {
		rec.Resource = &res
	})

	form := validExchangeForm(rawCode, verifier, "cli-res")
	form.Set("resource", "https://wrong.example.test/mcp")
	req := tokenRequest(form, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")
}

func TestTokenResourceOmittedIsAccepted(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	insertTokenTestClient(backend, "cli-res-omit", "none", nil, nil)
	verifier, challenge := s256Pair(t)
	res := "https://mcp.plytarium.com/mcp"
	rawCode, _ := insertTokenTestCode(t, backend, "cli-res-omit", challenge, func(rec *AuthCodeRecord) {
		rec.Resource = &res
	})

	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-res-omit"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want %d (body=%s)", rec.Code, http.StatusOK, rec.Body.String())
	}
}

func TestTokenExpiredCodeIsInvalidGrant(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	insertTokenTestClient(backend, "cli-expired", "none", nil, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-expired", challenge, func(rec *AuthCodeRecord) {
		rec.ExpiresAt = time.Now().Add(-1 * time.Second)
	})

	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-expired"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")
}

func TestTokenMissingRequiredFieldsAreInvalidGrant(t *testing.T) {
	cases := []struct {
		name  string
		strip func(url.Values)
	}{
		{"missing-code", func(v url.Values) { v.Del("code") }},
		{"missing-redirect-uri", func(v url.Values) { v.Del("redirect_uri") }},
		{"missing-code-verifier", func(v url.Values) { v.Del("code_verifier") }},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
			form := validExchangeForm(rawCode, verifier, "cli-tok")
			tc.strip(form)
			req := tokenRequest(form, "")
			rec := httptest.NewRecorder()
			srv.Token(rec, req)
			assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")
		})
	}
}

// TestTokenCodeSequentialReplayIsInvalidGrantSecondTime is the sequential
// half of T-08-CODE-REPLAY: exchanging the same code twice succeeds exactly
// once.
func TestTokenCodeSequentialReplayIsInvalidGrantSecondTime(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
	form := validExchangeForm(rawCode, verifier, "cli-tok")

	first := httptest.NewRecorder()
	srv.Token(first, tokenRequest(form, ""))
	if first.Code != http.StatusOK {
		t.Fatalf("first exchange status = %d, want %d (body=%s)", first.Code, http.StatusOK, first.Body.String())
	}

	second := httptest.NewRecorder()
	srv.Token(second, tokenRequest(form, ""))
	assertTokenError(t, second, http.StatusBadRequest, "invalid_grant")
}

// TestTokenCodeConcurrentReplayHasExactlyOneWinner is the concurrent half of
// T-08-CODE-REPLAY (Pitfall 8): two synchronized goroutines racing to
// exchange the same code must produce exactly one 200 and one invalid_grant,
// never two successes. memoryBackend serializes the whole WithinTx closure
// behind one mutex (08-PATTERNS.md), which is exactly the seam this test
// exercises; the real-Postgres row-lock proof lives in fonoteka.go's
// classes/auth package.
func TestTokenCodeConcurrentReplayHasExactlyOneWinner(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
	form := validExchangeForm(rawCode, verifier, "cli-tok")

	results := make([]int, 2)
	start := make(chan struct{})
	done := make(chan struct{})
	for i := range 2 {
		go func(i int) {
			<-start
			rec := httptest.NewRecorder()
			srv.Token(rec, tokenRequest(form, ""))
			results[i] = rec.Code
			done <- struct{}{}
		}(i)
	}
	close(start)
	<-done
	<-done

	successCount, grantErrCount := 0, 0
	for _, code := range results {
		switch code {
		case http.StatusOK:
			successCount++
		case http.StatusBadRequest:
			grantErrCount++
		default:
			t.Fatalf("unexpected status %d", code)
		}
	}
	if successCount != 1 || grantErrCount != 1 {
		t.Fatalf("successCount=%d grantErrCount=%d, want 1 and 1 (results=%v)", successCount, grantErrCount, results)
	}
}

func TestTokenOfflineAccessAppendedToScope(t *testing.T) {
	backend := newMemoryBackend()
	srv := newTestServer(backend)
	insertTokenTestClient(backend, "cli-offline", "none", nil, nil)
	verifier, challenge := s256Pair(t)
	rawCode, _ := insertTokenTestCode(t, backend, "cli-offline", challenge, func(rec *AuthCodeRecord) {
		rec.OfflineAccess = true
	})

	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-offline"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status = %d, want %d (body=%s)", rec.Code, http.StatusOK, rec.Body.String())
	}
	var got map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
		t.Fatal(err)
	}
	if got["scope"] != "read write offline_access" {
		t.Fatalf("scope = %v, want %q", got["scope"], "read write offline_access")
	}
}

func TestTokenSuccessResponseHasNoEnvelopeAndNoTrailingNewline(t *testing.T) {
	srv, _, verifier, rawCode, _ := newTokenExchangeFixture(t)
	req := tokenRequest(validExchangeForm(rawCode, verifier, "cli-tok"), "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)

	if strings.HasSuffix(rec.Body.String(), "\n") {
		t.Fatal("body has a trailing newline")
	}
	var got map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
		t.Fatal(err)
	}
	if _, hasData := got["data"]; hasData {
		t.Fatal("body has a house \"data\" envelope")
	}
	if got["expires_in"] != float64(3600) {
		t.Fatalf("expires_in = %v, want 3600", got["expires_in"])
	}
	if cc := rec.Header().Get("Cache-Control"); cc != "no-store" {
		t.Fatalf("Cache-Control = %q, want \"no-store\"", cc)
	}
	if p := rec.Header().Get("Pragma"); p != "no-cache" {
		t.Fatalf("Pragma = %q, want \"no-cache\"", p)
	}
}

// TestTokenRefreshGrantDispatchIsAcceptedButNotYetImplemented proves Token's
// own grant-type validity check accepts "refresh_token" exactly like PHP
// does (it is not unsupported_grant_type), while full rotation is 08-06's
// job in this plan's scope (see rotateRefreshToken).
func TestTokenRefreshGrantDispatchIsAcceptedButNotYetImplemented(t *testing.T) {
	srv, _, _, _, _ := newTokenExchangeFixture(t)
	req := tokenRequest(url.Values{
		"grant_type":    {"refresh_token"},
		"refresh_token": {"whatever"},
		"client_id":     {"cli-tok"},
	}, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	assertTokenError(t, rec, http.StatusBadRequest, "invalid_grant")
}

func TestTokenBackendUnavailableIsOpaque500(t *testing.T) {
	opts := DefaultOptions()
	opts.Issuer = "https://plytarium.com"
	srv := NewServer(opts)
	req := tokenRequest(url.Values{"grant_type": {"authorization_code"}}, "")
	rec := httptest.NewRecorder()
	srv.Token(rec, req)
	if rec.Code != http.StatusInternalServerError {
		t.Fatalf("status = %d, want %d", rec.Code, http.StatusInternalServerError)
	}
}