package auth

import (
	"strings"
	"testing"
)

func TestHashAndCheckPassword(t *testing.T) {
	hash, err := HashPassword("correct horse")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if !CheckPassword(hash, "correct horse") {
		t.Error("CheckPassword with the same password = false, want true")
	}
	if CheckPassword(hash, "battery staple") {
		t.Error("CheckPassword with wrong password = true, want false")
	}
	first, err := HashPassword("same password")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	second, err := HashPassword("same password")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if first == second {
		t.Error("two hashes of one password are identical, want salted")
	}
}

func TestNewToken(t *testing.T) {
	seen := map[string]bool{}
	for range 10 {
		token, err := NewToken()
		if err != nil {
			t.Fatalf("NewToken: %v", err)
		}
		if len(token) != 64 {
			t.Errorf("token length = %d, want 64", len(token))
		}
		if seen[token] {
			t.Errorf("token %s repeated", token)
		}
		seen[token] = true
	}
}

func TestAPIToken(t *testing.T) {
	seen := map[string]bool{}
	for range 10 {
		token, err := NewAPIToken()
		if err != nil {
			t.Fatalf("NewAPIToken: %v", err)
		}
		if !strings.HasPrefix(token, "sg_") {
			t.Errorf("token %q lacks sg_ prefix", token)
		}
		if seen[token] {
			t.Errorf("token %s repeated", token)
		}
		seen[token] = true
	}

	if HashToken("sg_abc") != HashToken("sg_abc") {
		t.Error("HashToken is not deterministic")
	}
	if HashToken("sg_abc") == HashToken("sg_abd") {
		t.Error("HashToken collided on differing input")
	}
	if len(HashToken("sg_abc")) != 64 {
		t.Errorf("hash length = %d, want 64", len(HashToken("sg_abc")))
	}

	if hint := TokenHint("sg_abcdefghij"); hint != "sg_abcde" {
		t.Errorf("TokenHint = %q, want sg_abcde", hint)
	}
	if hint := TokenHint("short"); hint != "short" {
		t.Errorf("TokenHint(short) = %q, want short", hint)
	}
}