package auth

import (
	"testing"

	"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
)

func TestValidatePasswordAcceptsLongRandom(t *testing.T) {
	t.Parallel()
	if err := ValidatePassword("Tr0ub4dor&3-extra!", "Admin"); err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
}

func TestValidatePasswordAcceptsPassphrase(t *testing.T) {
	t.Parallel()
	if err := ValidatePassword("apple banana cherry date elderberry", "Admin"); err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
}

func TestValidatePasswordRejectsShort(t *testing.T) {
	t.Parallel()
	if err := ValidatePassword("short-pass", "Admin"); err == nil {
		t.Fatal("expected error")
	}
}

func TestValidatePasswordRejectsUsername(t *testing.T) {
	t.Parallel()
	if err := ValidatePassword("AdminAdminAdmin!", "AdminAdminAdmin!"); err == nil {
		t.Fatal("expected error")
	}
}

func TestHashAndVerifyPassword(t *testing.T) {
	t.Parallel()
	hash, err := HashPassword("apple banana cherry date elderberry")
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	ok, err := VerifyPassword("apple banana cherry date elderberry", hash)
	if err != nil || !ok {
		t.Fatalf("VerifyPassword failed: ok=%v err=%v", ok, err)
	}
	ok, err = VerifyPassword("wrong password here!!", hash)
	if err != nil {
		t.Fatalf("VerifyPassword error: %v", err)
	}
	if ok {
		t.Fatal("expected mismatch")
	}
}

func TestWouldLockOutWhitelist(t *testing.T) {
	t.Parallel()
	network := settings.NetworkSettings{
		AccessMode: settings.AccessModeWhitelist,
		Rules:      []string{"10.0.0.0/8"},
	}
	locked, _ := WouldLockOut("192.168.1.5", network)
	if !locked {
		t.Fatal("expected lock out")
	}
	locked, _ = WouldLockOut("10.1.2.3", network)
	if locked {
		t.Fatal("expected allow")
	}
}