package crypto

import "testing"

func TestPasswordHashRoundTrip(t *testing.T) {
	h := NewPasswordHasher(3, 64*1024, 2, 32, 16)
	hash, err := h.HashPassword("s3cret-password")
	if err != nil {
		t.Fatalf("hash: %v", err)
	}
	ok, err := h.VerifyPassword(hash, "s3cret-password")
	if err != nil || !ok {
		t.Fatalf("verify correct password: ok=%v err=%v", ok, err)
	}
	ok, _ = h.VerifyPassword(hash, "wrong-password")
	if ok {
		t.Fatal("wrong password should not verify")
	}
}

func TestEncryptDecrypt(t *testing.T) {
	e := NewEncryptor("master-key-0123456789abcdef")
	enc, err := e.Encrypt("sk-upstream-secret")
	if err != nil {
		t.Fatalf("encrypt: %v", err)
	}
	dec, err := e.Decrypt(enc)
	if err != nil || dec != "sk-upstream-secret" {
		t.Fatalf("decrypt: got %q err %v", dec, err)
	}
	// 密文不可读
	if dec == enc {
		t.Fatal("ciphertext should differ from plaintext")
	}
}

func TestShortMasterKeyDerived(t *testing.T) {
	e := NewEncryptor("short")
	enc, _ := e.Encrypt("x")
	dec, err := e.Decrypt(enc)
	if err != nil || dec != "x" {
		t.Fatalf("short key derive failed: %v", err)
	}
}