"""Synthetic local issuer. Requires PyJWT; never paste production tokens here."""
import secrets
import time
import jwt
key = secrets.token_urlsafe(48)
claims = {'sub': 'fixture-a', 'iss': 'https://issuer.example', 'aud': 'api-a', 'exp': int(time.time()) + 60}
cases = [
    ('valid', jwt.encode(claims, key, algorithm='HS256'), True),
    ('wrong audience', jwt.encode({**claims, 'aud': 'api-b'}, key, algorithm='HS256'), False),
    ('wrong issuer', jwt.encode({**claims, 'iss': 'https://other.example'}, key, algorithm='HS256'), False),
    ('expired', jwt.encode({**claims, 'exp': 1}, key, algorithm='HS256'), False),
    ('missing expiry', jwt.encode({k:v for k,v in claims.items() if k != 'exp'}, key, algorithm='HS256'), False),
    ('wrong key', jwt.encode(claims, secrets.token_urlsafe(48), algorithm='HS256'), False),
    ('missing token', '', False),
]
for name, token, expected in cases:
    try:
        jwt.decode(token, key, algorithms=['HS256'], audience='api-a', issuer=claims['iss'], options={'require': ['exp', 'iss', 'aud', 'sub']})
        accepted = True
    except jwt.InvalidTokenError:
        accepted = False
    assert accepted == expected, name
    print(name, 'PASS')
assert claims['sub'] != 'fixture-b'  # Separate object ownership check.
print('valid token does not grant foreign object access: PASS')
print('PyJWT version:', jwt.__version__)