import { describe, it, expect } from 'vitest';
import { hashPassword, verifyPassword } from '../src/auth/password.js';

describe('password hashing (argon2)', () => {
  it('verifies a correct password against its hash', async () => {
    const hash = await hashPassword('correct horse battery staple');
    expect(await verifyPassword(hash, 'correct horse battery staple')).toBe(true);
  });

  it('rejects a wrong password', async () => {
    const hash = await hashPassword('correct horse battery staple');
    expect(await verifyPassword(hash, 'Tr0ub4dor&3')).toBe(false);
  });

  it('produces an argon2id hash, not plaintext', async () => {
    const hash = await hashPassword('s3cret');
    expect(hash).toMatch(/^\$argon2id\$/);
    expect(hash).not.toContain('s3cret');
  });

  it('produces a different hash each time (random salt) but both verify', async () => {
    const a = await hashPassword('same-password');
    const b = await hashPassword('same-password');
    expect(a).not.toBe(b);
    expect(await verifyPassword(a, 'same-password')).toBe(true);
    expect(await verifyPassword(b, 'same-password')).toBe(true);
  });

  it('is case-sensitive', async () => {
    const hash = await hashPassword('CaseSensitive');
    expect(await verifyPassword(hash, 'casesensitive')).toBe(false);
  });
});