package crypto

import "testing"

func TestPasswordHashRoundTrip(t *testing.T) {
	h := NewPasswordHasher(1, 64*1024, 1, 32, 16)
	hash, err := h.HashPassword("s3cret-password")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	ok, err := h.VerifyPassword(hash, "s3cret-password")
	if err != nil || !ok {
		t.Fatalf("VerifyPassword correct: ok=%v err=%v", ok, err)
	}
	ok, _ = h.VerifyPassword(hash, "wrong-password")
	if ok {
		t.Fatal("VerifyPassword accepted wrong password")
	}
}

func TestEncryptorRoundTrip(t *testing.T) {
	e := NewEncryptor("a-very-long-master-key-1234567890")
	enc, err := e.Encrypt("sk-upstream-secret")
	if err != nil {
		t.Fatalf("Encrypt: %v", err)
	}
	if enc == "sk-upstream-secret" {
		t.Fatal("ciphertext equals plaintext")
	}
	plain, err := e.Decrypt(enc)
	if err != nil {
		t.Fatalf("Decrypt: %v", err)
	}
	if plain != "sk-upstream-secret" {
		t.Fatalf("round trip mismatch: %q", plain)
	}
}

func TestEncryptorShortKeyDerived(t *testing.T) {
	// 短主密钥应派生 32 字节而非报错
	e := NewEncryptor("short")
	if _, err := e.Encrypt("x"); err != nil {
		t.Fatalf("Encrypt with short key: %v", err)
	}
}