package crypto

import (
	"testing"

	"github.com/stretchr/testify/assert"
)

// --- HashPassword and CheckPassword Tests ---

func TestHashPassword_Success(t *testing.T) {
	hash, err := HashPassword("mypassword123")
	assert.NoError(t, err)
	assert.NotEmpty(t, hash)
	// bcrypt hashes should start with "$2a$" or "$2b$"
	assert.Contains(t, hash, "$2")
}

func TestCheckPassword_Matches(t *testing.T) {
	hash, err := HashPassword("securepassword")
	assert.NoError(t, err)

	result := CheckPassword("securepassword", hash)
	assert.True(t, result)
}

func TestCheckPassword_DoesNotMatch(t *testing.T) {
	hash, err := HashPassword("securepassword")
	assert.NoError(t, err)

	result := CheckPassword("wrongpassword", hash)
	assert.False(t, result)
}

func TestHashPassword_DifferentHashesForSamePassword(t *testing.T) {
	hash1, err := HashPassword("samepassword")
	assert.NoError(t, err)

	hash2, err := HashPassword("samepassword")
	assert.NoError(t, err)

	// bcrypt uses random salt, so hashes should differ
	assert.NotEqual(t, hash1, hash2)

	// But both should validate against the same password
	assert.True(t, CheckPassword("samepassword", hash1))
	assert.True(t, CheckPassword("samepassword", hash2))
}

func TestHashPassword_EmptyPassword(t *testing.T) {
	hash, err := HashPassword("")
	assert.NoError(t, err)
	assert.True(t, CheckPassword("", hash))
}

// --- JWT GenerateToken and ValidateToken Tests ---

func TestGenerateToken_Success(t *testing.T) {
	cfg := JWTConfig{
		Secret:           []byte("test-jwt-secret"),
		ExpiryHours:      1,
		RefreshExpiryHours: 24,
	}

	token, err := GenerateToken(cfg, 1, "user@example.com", "agent")
	assert.NoError(t, err)
	assert.NotEmpty(t, token)
}

func TestValidateToken_Valid(t *testing.T) {
	cfg := JWTConfig{
		Secret:           []byte("test-jwt-secret"),
		ExpiryHours:      1,
		RefreshExpiryHours: 24,
	}

	token, err := GenerateToken(cfg, 42, "test@example.com", "administrator")
	assert.NoError(t, err)

	claims, err := ValidateToken(cfg, token)
	assert.NoError(t, err)
	assert.Equal(t, float64(42), claims["user_id"])
	assert.Equal(t, "test@example.com", claims["email"])
	assert.Equal(t, "administrator", claims["type"])
}

func TestValidateToken_InvalidSignature(t *testing.T) {
	cfg := JWTConfig{
		Secret:           []byte("correct-secret"),
		ExpiryHours:      1,
		RefreshExpiryHours: 24,
	}

	token, err := GenerateToken(cfg, 1, "user@example.com", "agent")
	assert.NoError(t, err)

	wrongCfg := JWTConfig{
		Secret:           []byte("wrong-secret"),
		ExpiryHours:      1,
		RefreshExpiryHours: 24,
	}

	claims, err := ValidateToken(wrongCfg, token)
	assert.Error(t, err)
	assert.Nil(t, claims)
}

func TestValidateToken_MalformedToken(t *testing.T) {
	cfg := JWTConfig{
		Secret:           []byte("test-jwt-secret"),
		ExpiryHours:      1,
		RefreshExpiryHours: 24,
	}

	claims, err := ValidateToken(cfg, "invalid-token-string")
	assert.Error(t, err)
	assert.Nil(t, claims)
}

// --- JWTConfig Tests ---

func TestJWTConfig_Fields(t *testing.T) {
	cfg := JWTConfig{
		Secret:           []byte("secret"),
		ExpiryHours:      2,
		RefreshExpiryHours: 48,
	}
	assert.Equal(t, []byte("secret"), cfg.Secret)
	assert.Equal(t, 2, cfg.ExpiryHours)
	assert.Equal(t, 48, cfg.RefreshExpiryHours)
}