package crypto

import (
	"strings"
	"testing"
)

func TestPasswordHashRoundTrip(t *testing.T) {
	h := NewPasswordHasher(1, 64*1024, 1, 32, 16)
	hash, err := h.HashPassword("s3cret-password")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	ok, err := h.VerifyPassword(hash, "s3cret-password")
	if err != nil || !ok {
		t.Fatalf("VerifyPassword correct: ok=%v err=%v", ok, err)
	}
	ok, _ = h.VerifyPassword(hash, "wrong-password")
	if ok {
		t.Fatal("VerifyPassword accepted wrong password")
	}
}

func TestEncryptorRoundTrip(t *testing.T) {
	e := NewEncryptor("a-very-long-master-key-1234567890")
	enc, err := e.Encrypt("sk-upstream-secret")
	if err != nil {
		t.Fatalf("Encrypt: %v", err)
	}
	if enc == "sk-upstream-secret" {
		t.Fatal("ciphertext equals plaintext")
	}
	plain, err := e.Decrypt(enc)
	if err != nil {
		t.Fatalf("Decrypt: %v", err)
	}
	if plain != "sk-upstream-secret" {
		t.Fatalf("round trip mismatch: %q", plain)
	}
}

func TestEncryptorShortKeyDerived(t *testing.T) {
	// 短主密钥应派生 32 字节而非报错
	e := NewEncryptor("short")
	if _, err := e.Encrypt("x"); err != nil {
		t.Fatalf("Encrypt with short key: %v", err)
	}
}

// 主密钥换过（值不同）必然解不开：这是 "failed to decrypt channel key" 的根因。
func TestEncryptorWrongKeyFails(t *testing.T) {
	a := NewEncryptor("master-key-AAAAAAAAAAAAAAAAAAAAAAAA")
	b := NewEncryptor("master-key-BBBBBBBBBBBBBBBBBBBBBBBB")
	enc, err := a.Encrypt("sk-upstream-secret")
	if err != nil {
		t.Fatalf("Encrypt: %v", err)
	}
	if _, err := b.Decrypt(enc); err == nil {
		t.Fatal("换了主密钥仍能解密：加解密强度有问题")
	}
}

// 长度陷阱：32 字节走原始字节，33 字节走 SHA-256 派生，两者是不同的密钥。
func TestEncryptorKeyLengthModeSwitch(t *testing.T) {
	raw32 := "0123456789abcdef0123456789abcdef" // 32 字节
	derived := raw32 + "x"                      // 33 字节 → 派生
	enc, err := NewEncryptor(raw32).Encrypt("secret")
	if err != nil {
		t.Fatalf("Encrypt: %v", err)
	}
	if _, err := NewEncryptor(derived).Decrypt(enc); err == nil {
		t.Fatal("长度变化后仍在用同一把密钥：派生路径切换应导致解密失败")
	}
	if got := NewEncryptor(raw32).KeyMode(); got == "" || !strings.Contains(got, "raw-32") {
		t.Fatalf("32 字节应报 raw-32，实际 %q", got)
	}
	if got := NewEncryptor(derived).KeyMode(); !strings.Contains(got, "derived-32") {
		t.Fatalf("33 字节应报 derived-32，实际 %q", got)
	}
}

// 指纹只用于比对，不泄露密钥；同密钥同指纹、异密钥异指纹。
func TestEncryptorKeyFingerprint(t *testing.T) {
	a1 := NewEncryptor("same-master-key-1234567890")
	a2 := NewEncryptor("same-master-key-1234567890")
	b := NewEncryptor("other-master-key-123456789")
	if a1.KeyFingerprint() != a2.KeyFingerprint() {
		t.Fatal("同一主密钥的指纹应一致")
	}
	if a1.KeyFingerprint() == b.KeyFingerprint() {
		t.Fatal("不同主密钥的指纹不应相同")
	}
	if len(a1.KeyFingerprint()) != 8 {
		t.Fatalf("指纹应为 4 字节 hex（8 字符），实际 %q", a1.KeyFingerprint())
	}
	if strings.Contains(a1.KeyFingerprint(), "same-master-key") {
		t.Fatal("指纹不应包含密钥内容")
	}
}