import time
import pytest
from fastapi import HTTPException
from sourcehub.security import DownloadSigner


def test_download_signer_valid_and_tamper():
    s=DownloadSigner("abcdefghijklmnopqrstuvwxyz-1234567890",ttl_seconds=60)
    token=s.issue("rev1","dev1")
    assert s.verify(token,"rev1")["rid"]=="rev1"
    with pytest.raises(HTTPException):
        s.verify(token+"x","rev1")
    with pytest.raises(HTTPException):
        s.verify(token,"rev2")