package auth

import "testing"

func TestHashAndVerifyPassword(t *testing.T) {
	hash, err := HashPassword("correct horse battery staple")
	if err != nil {
		t.Fatal(err)
	}
	ok, err := VerifyPassword("correct horse battery staple", hash)
	if err != nil {
		t.Fatal(err)
	}
	if !ok {
		t.Fatal("expected password to verify")
	}
	ok, err = VerifyPassword("wrong password", hash)
	if err != nil {
		t.Fatal(err)
	}
	if ok {
		t.Fatal("expected wrong password to fail verification")
	}
}

func TestGenerateRandomPassword(t *testing.T) {
	p1, err := GenerateRandomPassword()
	if err != nil {
		t.Fatal(err)
	}
	p2, err := GenerateRandomPassword()
	if err != nil {
		t.Fatal(err)
	}
	if p1 == p2 {
		t.Fatal("expected distinct random passwords")
	}
	if len(p1) < 20 {
		t.Fatalf("password too short: %q", p1)
	}
}

func TestAPITokenRoundTrip(t *testing.T) {
	plaintext, hash, prefix, err := GenerateAPIToken()
	if err != nil {
		t.Fatal(err)
	}
	if HashAPIToken(plaintext) != hash {
		t.Fatal("hash mismatch")
	}
	if len(prefix) != 8 {
		t.Fatalf("expected 8-char prefix, got %q", prefix)
	}
}