package auth

import (
	"strings"
	"testing"
)

func TestValidateBearerToken_JWEGetsClearError(t *testing.T) {
	ti := newTestIssuer(t)
	host, port, _ := strings.Cut(strings.TrimPrefix(ti.server.URL, "http://"), ":")
	v, err := NewZitadelValidator(t.Context(), ti.server.URL, nil, ZitadelConfig{
		Domain: host, InsecurePort: port, HTTPClient: ti.server.Client(),
	})
	if err != nil {
		t.Fatalf("NewZitadelValidator: %v", err)
	}
	_, err = v.ValidateBearerToken("Bearer a.b.c.d.e")
	if err == nil || !strings.Contains(err.Error(), "encrypted JWE") {
		t.Fatalf("expected a JWE-specific error, got %v", err)
	}
}