package auth

import (
	"strings"
	"testing"
)

func TestGenerateAppPasswordFormat(t *testing.T) {
	token, err := GenerateAppPassword()
	if err != nil {
		t.Fatalf("GenerateAppPassword: %v", err)
	}

	groups := strings.Split(token, "-")
	if len(groups) != appPasswordGroups {
		t.Fatalf("got %d groups, want %d (%q)", len(groups), appPasswordGroups, token)
	}
	for _, g := range groups {
		if len(g) != appPasswordGroupLen {
			t.Fatalf("group %q has length %d, want %d", g, len(g), appPasswordGroupLen)
		}
		for _, c := range g {
			if !strings.ContainsRune(appPasswordAlphabet, c) {
				t.Fatalf("character %q is outside the alphabet – hard to type on a phone", c)
			}
		}
	}
}

func TestGenerateAppPasswordIsRandom(t *testing.T) {
	seen := make(map[string]bool, 100)
	for i := 0; i < 100; i++ {
		token, err := GenerateAppPassword()
		if err != nil {
			t.Fatalf("GenerateAppPassword: %v", err)
		}
		if seen[token] {
			t.Fatalf("duplicate token after %d draws: %q", i, token)
		}
		seen[token] = true
	}
}

// Der Klartext darf nie gespeichert werden – gehasht wird deterministisch,
// damit der Login ein reiner Index-Lookup bleibt.
func TestHashAppPassword(t *testing.T) {
	const token = "abcde-fghij-klmno-pqrst-uvwxy"

	h := HashAppPassword(token)
	if h == token || strings.Contains(h, token) {
		t.Fatal("hash leaks the plaintext token")
	}
	if len(h) != 64 {
		t.Fatalf("hash length = %d, want 64 hex chars", len(h))
	}
	if h != HashAppPassword(token) {
		t.Fatal("hash is not deterministic")
	}
	if h == HashAppPassword("abcde-fghij-klmno-pqrst-uvwxz") {
		t.Fatal("different tokens hash to the same value")
	}
	// Clients hängen beim Kopieren gern Whitespace an.
	if h != HashAppPassword("  "+token+"\n") {
		t.Fatal("surrounding whitespace changes the hash")
	}
}