chore: update

control-plane/api/internal/auth/password_test.go

@@ -0,0 +1,62 @@
+package auth
+
+import "testing"
+
+func TestHashPassword_VerifyPassword_Roundtrip(t *testing.T) {
+	hash, err := HashPassword("correct horse battery staple")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+
+	ok, err := VerifyPassword("correct horse battery staple", hash)
+	if err != nil {
+		t.Fatalf("VerifyPassword: %v", err)
+	}
+	if !ok {
+		t.Error("VerifyPassword = false, want true for correct password")
+	}
+}
+
+func TestVerifyPassword_WrongPassword(t *testing.T) {
+	hash, err := HashPassword("correct horse battery staple")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+
+	ok, err := VerifyPassword("wrong password", hash)
+	if err != nil {
+		t.Fatalf("VerifyPassword: %v", err)
+	}
+	if ok {
+		t.Error("VerifyPassword = true, want false for wrong password")
+	}
+}
+
+func TestHashPassword_UniqueSaltPerCall(t *testing.T) {
+	hash1, err := HashPassword("same password")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	hash2, err := HashPassword("same password")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	if hash1 == hash2 {
+		t.Error("HashPassword produced identical hashes for two calls — salt is not random")
+	}
+}
+
+func TestVerifyPassword_InvalidHashFormat(t *testing.T) {
+	cases := []string{
+		"",
+		"not-a-hash",
+		"$argon2id$v=19$m=65536,t=1,p=4$onlyfiveparts",
+		"$bcrypt$v=19$m=65536,t=1,p=4$c2FsdA$aGFzaA",
+	}
+	for _, encoded := range cases {
+		_, err := VerifyPassword("anything", encoded)
+		if err != ErrInvalidHash {
+			t.Errorf("VerifyPassword(%q) error = %v, want ErrInvalidHash", encoded, err)
+		}
+	}
+}