package authn

import (
	"errors"
	"testing"
)

func TestPasswordHasherRoundTrip(t *testing.T) {
	t.Parallel()

	hasher := newPasswordHasher(Argon2Parameters{MemoryKiB: 8 * 1024, Time: 1, Threads: 1, SaltBytes: 16, KeyBytes: 32})
	encoded, err := hasher.Hash("a correct horse battery staple")
	if err != nil {
		t.Fatalf("Hash returned an error: %v", err)
	}
	valid, err := hasher.Verify("a correct horse battery staple", encoded)
	if err != nil {
		t.Fatalf("Verify returned an error: %v", err)
	}
	if !valid {
		t.Fatal("Verify = false, want true")
	}
	valid, err = hasher.Verify("wrong password", encoded)
	if err != nil {
		t.Fatalf("Verify wrong password returned an error: %v", err)
	}
	if valid {
		t.Fatal("Verify wrong password = true, want false")
	}
}

func TestPasswordHasherRejectsUnboundedParameters(t *testing.T) {
	t.Parallel()

	hasher := NewPasswordHasher()
	_, err := hasher.Verify("password", "$argon2id$v=19$m=4294967295,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$ZGVyaXZlZGRlcml2ZWRkZXJpdmVkZGVyaXZlZA")
	if !errors.Is(err, ErrInvalidPasswordHash) {
		t.Fatalf("Verify error = %v, want %v", err, ErrInvalidPasswordHash)
	}
}