from app.config import settings
from app.utils.security import create_access_token, decode_token


def test_jwt_round_trip_and_tamper_rejection(monkeypatch):
    monkeypatch.setattr(settings, "SECRET_KEY", "x" * 32)
    token = create_access_token({"user_id": "user-1", "role": "manager"})

    assert decode_token(token)["user_id"] == "user-1"
    assert decode_token(f"{token}tampered") is None