package auth

import "testing"

func TestHashPassword_VerifyPassword_Roundtrip(t *testing.T) {
	hash, err := HashPassword("correct horse battery staple")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}

	ok, err := VerifyPassword("correct horse battery staple", hash)
	if err != nil {
		t.Fatalf("VerifyPassword: %v", err)
	}
	if !ok {
		t.Error("VerifyPassword = false, want true for correct password")
	}
}

func TestVerifyPassword_WrongPassword(t *testing.T) {
	hash, err := HashPassword("correct horse battery staple")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}

	ok, err := VerifyPassword("wrong password", hash)
	if err != nil {
		t.Fatalf("VerifyPassword: %v", err)
	}
	if ok {
		t.Error("VerifyPassword = true, want false for wrong password")
	}
}

func TestHashPassword_UniqueSaltPerCall(t *testing.T) {
	hash1, err := HashPassword("same password")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	hash2, err := HashPassword("same password")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if hash1 == hash2 {
		t.Error("HashPassword produced identical hashes for two calls — salt is not random")
	}
}

func TestVerifyPassword_InvalidHashFormat(t *testing.T) {
	cases := []string{
		"",
		"not-a-hash",
		"$argon2id$v=19$m=65536,t=1,p=4$onlyfiveparts",
		"$bcrypt$v=19$m=65536,t=1,p=4$c2FsdA$aGFzaA",
	}
	for _, encoded := range cases {
		_, err := VerifyPassword("anything", encoded)
		if err != ErrInvalidHash {
			t.Errorf("VerifyPassword(%q) error = %v, want ErrInvalidHash", encoded, err)
		}
	}
}