package webapp

import (
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestGenerateFirstRunPassword(t *testing.T) {
	a, err := GenerateFirstRunPassword()
	require.NoError(t, err)
	require.NotEmpty(t, a)
	// 24 bytes -> 32 base64 chars (RawURLEncoding, no padding).
	assert.Len(t, a, 32, "first-run password length")

	// Two calls must produce different passwords (statistically
	// certain with crypto/rand).
	b, err := GenerateFirstRunPassword()
	require.NoError(t, err)
	assert.NotEqual(t, a, b, "two calls must produce distinct passwords")
}

func TestHashAndVerifyPassword(t *testing.T) {
	const plain = "correct horse battery staple"
	hash, err := HashPassword(plain)
	require.NoError(t, err)
	require.NotEmpty(t, hash)
	assert.True(t, strings.HasPrefix(hash, "$2a$"),
		"bcrypt hash should start with $2a$")

	require.NoError(t, VerifyPassword(hash, plain),
		"correct password must verify")
	assert.Error(t, VerifyPassword(hash, "wrong password"),
		"wrong password must not verify")
}

func TestHashPasswordRejectsEmpty(t *testing.T) {
	_, err := HashPassword("")
	assert.Error(t, err, "empty plaintext must be rejected")
}

func TestMaskToken(t *testing.T) {
	assert.Equal(t, "—", MaskToken(""))
	assert.Equal(t, "****", MaskToken("abcd"))
	assert.Equal(t, "****wxyz", MaskToken("abcdefghwxyz"))
}