package auth

import (
	"crypto/sha256"
	"encoding/hex"
	"testing"
)

func TestPasswordHashUsesBcryptAndVerifies(t *testing.T) {
	hash := PasswordHash("correct horse battery staple")
	if len(hash) < 4 || (hash[0:4] != "$2a$" && hash[0:4] != "$2b$") {
		t.Fatalf("hash=%q is not bcrypt", hash)
	}
	if !VerifyPasswordHash(hash, "correct horse battery staple") {
		t.Fatal("bcrypt password did not verify")
	}
	if VerifyPasswordHash(hash, "wrong") {
		t.Fatal("wrong password verified")
	}
}

func TestLegacySHA256PasswordStillVerifies(t *testing.T) {
	sum := sha256.Sum256([]byte("legacy-pass"))
	hash := hex.EncodeToString(sum[:])
	if !VerifyPasswordHash(hash, "legacy-pass") {
		t.Fatal("legacy hash did not verify")
	}
	if VerifyPasswordHash(hash, "wrong") {
		t.Fatal("wrong legacy password verified")
	}
}