package auth_test

import (
	"testing"

	"github.com/netcell-it/deklarix/internal/auth"
)

func TestHashPasswordRejectsShortPassword(t *testing.T) {
	if _, err := auth.HashPassword("kurz"); err == nil {
		t.Fatal("expected error for a too-short password, got nil")
	}
}

func TestHashAndVerifyRoundTrip(t *testing.T) {
	hash, err := auth.HashPassword("ein-langes-passwort")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if err := auth.VerifyPassword(hash, "ein-langes-passwort"); err != nil {
		t.Fatalf("VerifyPassword: %v", err)
	}
}

func TestVerifyPasswordRejectsWrongPassword(t *testing.T) {
	hash, err := auth.HashPassword("ein-langes-passwort")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if err := auth.VerifyPassword(hash, "falsches-passwort"); err == nil {
		t.Fatal("expected error for a wrong password, got nil")
	}
}

func TestNewSessionTokenIsRandomAndCorrectLength(t *testing.T) {
	a, err := auth.NewSessionToken()
	if err != nil {
		t.Fatalf("NewSessionToken: %v", err)
	}
	b, err := auth.NewSessionToken()
	if err != nil {
		t.Fatalf("NewSessionToken: %v", err)
	}
	if a == b {
		t.Fatal("expected two distinct tokens, got the same value twice")
	}
	if len(a) != 64 {
		t.Fatalf("token length = %d, want 64 (hex of 32 random bytes)", len(a))
	}
}