package player

import (
	"strings"
	"testing"
)

func TestHashPasswordUsesArgon2idAndVerifies(t *testing.T) {
	hash, err := HashPassword("secret password")
	if err != nil {
		t.Fatal(err)
	}
	if !strings.HasPrefix(hash, "argon2id:") {
		t.Fatalf("hash format = %q, want argon2id", hash)
	}
	if !CheckPassword("secret password", hash) {
		t.Fatal("correct password rejected")
	}
	if CheckPassword("wrong password", hash) {
		t.Fatal("wrong password accepted")
	}
	// Salts must be unique per call: two hashes of the same password differ.
	other, _ := HashPassword("secret password")
	if other == hash {
		t.Fatal("two hashes of the same password are identical (salt reuse)")
	}
}

func TestCheckPasswordRejectsGarbage(t *testing.T) {
	for _, stored := range []string{
		"",
		"plain",
		"argon2id:1:2:3:no-salt:zz",
		"unknown:v1:salt:deadbeef",
		// Legacy single-pass SHA-256 hashes are no longer accepted.
		"sha256:AAAAAAAAAAAAAAAAAAAAAA:0011223344556677889900112233445566778899001122334455667788990011",
	} {
		if CheckPassword("anything", stored) {
			t.Fatalf("garbage hash accepted: %q", stored)
		}
	}
}