package security_test

import (
	"testing"

	"backend/internal/platform/security"
)

func TestHashAndVerifyPassword_RoundTrip(t *testing.T) {
	hash, err := security.HashPassword("correct-horse-battery-staple")
	if err != nil {
		t.Fatalf("HashPassword() error = %v", err)
	}

	ok, err := security.VerifyPassword(hash, "correct-horse-battery-staple")
	if err != nil {
		t.Fatalf("VerifyPassword() error = %v", err)
	}
	if !ok {
		t.Fatal("VerifyPassword() = false, want true for the correct password")
	}
}

func TestVerifyPassword_WrongPassword(t *testing.T) {
	hash, err := security.HashPassword("correct-horse-battery-staple")
	if err != nil {
		t.Fatalf("HashPassword() error = %v", err)
	}

	ok, err := security.VerifyPassword(hash, "wrong-password")
	if err != nil {
		t.Fatalf("VerifyPassword() error = %v", err)
	}
	if ok {
		t.Fatal("VerifyPassword() = true, want false for a wrong password")
	}
}

func TestHashPassword_UniqueSaltPerCall(t *testing.T) {
	hash1, err := security.HashPassword("same-password")
	if err != nil {
		t.Fatalf("HashPassword() error = %v", err)
	}
	hash2, err := security.HashPassword("same-password")
	if err != nil {
		t.Fatalf("HashPassword() error = %v", err)
	}
	if hash1 == hash2 {
		t.Fatal("two hashes of the same password with random salts must differ")
	}
}

func TestVerifyPassword_InvalidFormat(t *testing.T) {
	_, err := security.VerifyPassword("not-a-valid-hash", "whatever")
	if err == nil {
		t.Fatal("VerifyPassword() error = nil, want error for malformed hash")
	}
}

func TestVerifyPassword_TamperedHash(t *testing.T) {
	hash, err := security.HashPassword("correct-horse-battery-staple")
	if err != nil {
		t.Fatalf("HashPassword() error = %v", err)
	}

	tampered := hash[:len(hash)-4] + "abcd"
	ok, _ := security.VerifyPassword(tampered, "correct-horse-battery-staple")
	if ok {
		t.Fatal("VerifyPassword() = true for a tampered hash, want false")
	}
}