first

backend/test/security/password_test.go

@@ -0,0 +1,71 @@
+package security_test
+
+import (
+	"testing"
+
+	"backend/internal/platform/security"
+)
+
+func TestHashAndVerifyPassword_RoundTrip(t *testing.T) {
+	hash, err := security.HashPassword("correct-horse-battery-staple")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+
+	ok, err := security.VerifyPassword(hash, "correct-horse-battery-staple")
+	if err != nil {
+		t.Fatalf("VerifyPassword() error = %v", err)
+	}
+	if !ok {
+		t.Fatal("VerifyPassword() = false, want true for the correct password")
+	}
+}
+
+func TestVerifyPassword_WrongPassword(t *testing.T) {
+	hash, err := security.HashPassword("correct-horse-battery-staple")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+
+	ok, err := security.VerifyPassword(hash, "wrong-password")
+	if err != nil {
+		t.Fatalf("VerifyPassword() error = %v", err)
+	}
+	if ok {
+		t.Fatal("VerifyPassword() = true, want false for a wrong password")
+	}
+}
+
+func TestHashPassword_UniqueSaltPerCall(t *testing.T) {
+	hash1, err := security.HashPassword("same-password")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+	hash2, err := security.HashPassword("same-password")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+	if hash1 == hash2 {
+		t.Fatal("two hashes of the same password with random salts must differ")
+	}
+}
+
+func TestVerifyPassword_InvalidFormat(t *testing.T) {
+	_, err := security.VerifyPassword("not-a-valid-hash", "whatever")
+	if err == nil {
+		t.Fatal("VerifyPassword() error = nil, want error for malformed hash")
+	}
+}
+
+func TestVerifyPassword_TamperedHash(t *testing.T) {
+	hash, err := security.HashPassword("correct-horse-battery-staple")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+
+	tampered := hash[:len(hash)-4] + "abcd"
+	ok, _ := security.VerifyPassword(tampered, "correct-horse-battery-staple")
+	if ok {
+		t.Fatal("VerifyPassword() = true for a tampered hash, want false")
+	}
+}