package identity

import "testing"

func TestPasswordHasherMatchesPythonGatewayFormat(t *testing.T) {
	stored := "pbkdf2_sha256$600000$00112233445566778899aabbccddeeff$afca0887b188255f525e15e30f5aa5a0b210a3e253bfaf9630411f0782bb6573"
	hasher := PasswordHasher{}
	if !hasher.Verify("correct horse battery staple", stored) {
		t.Fatal("expected Python-compatible password to verify")
	}
	if hasher.Verify("wrong", stored) {
		t.Fatal("wrong password must not verify")
	}
}

func TestPasswordHasherAcceptsLegacyFormat(t *testing.T) {
	stored := "abcd1234$a377be9840f0f48e6a0f3577f08a9e56e095561e1e313517e3d589739f8d6907"
	hasher := PasswordHasher{}
	if !hasher.Verify("legacy", stored) {
		t.Fatal("expected legacy password to verify")
	}
	if !hasher.NeedsUpgrade(stored) {
		t.Fatal("legacy password should require upgrade")
	}
}

func TestHashRoundTrip(t *testing.T) {
	hasher := PasswordHasher{}
	stored, err := hasher.Hash("long-enough-password")
	if err != nil {
		t.Fatal(err)
	}
	if !hasher.Verify("long-enough-password", stored) {
		t.Fatal("new hash did not verify")
	}
}