package auth

import (
	"strings"
	"testing"
)

func TestHashPasswordRejectsShort(t *testing.T) {
	t.Parallel()
	_, err := HashPassword("short")
	if err == nil {
		t.Fatal("expected error for password shorter than 8 characters")
	}
}

func TestHashPasswordAndVerifyRoundTrip(t *testing.T) {
	t.Parallel()
	const password = "correct-horse-battery"
	encoded, err := HashPassword(password)
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if !strings.HasPrefix(encoded, "$argon2id$") {
		t.Fatalf("unexpected encoding prefix: %q", encoded)
	}
	ok, err := VerifyPassword(encoded, password)
	if err != nil {
		t.Fatalf("VerifyPassword: %v", err)
	}
	if !ok {
		t.Fatal("expected password to verify")
	}
	ok, err = VerifyPassword(encoded, "wrong-password")
	if err != nil {
		t.Fatalf("VerifyPassword wrong: %v", err)
	}
	if ok {
		t.Fatal("expected wrong password to fail verification")
	}
}

func TestVerifyPasswordInvalidFormat(t *testing.T) {
	t.Parallel()
	_, err := VerifyPassword("not-a-hash", "anything12")
	if err == nil {
		t.Fatal("expected invalid format error")
	}
}

func TestRandomTokenLength(t *testing.T) {
	t.Parallel()
	tok, err := RandomToken(24)
	if err != nil {
		t.Fatalf("RandomToken: %v", err)
	}
	if len(tok) != 48 {
		t.Fatalf("expected hex length 48, got %d (%q)", len(tok), tok)
	}
}