using System;
using StellaOps.Cryptography;
using Xunit;

namespace StellaOps.Cryptography.Tests;

public class Pbkdf2PasswordHasherTests
{
    private readonly Pbkdf2PasswordHasher hasher = new();

    [Fact]
    public void Hash_ProducesLegacyFormat()
    {
        var options = new PasswordHashOptions
        {
            Algorithm = PasswordHashAlgorithm.Pbkdf2,
            Iterations = 210_000
        };

        var encoded = hasher.Hash("s3cret", options);

        Assert.StartsWith("PBKDF2.", encoded, StringComparison.Ordinal);
    }

    [Fact]
    public void Verify_Succeeds_ForCorrectPassword()
    {
        var options = new PasswordHashOptions
        {
            Algorithm = PasswordHashAlgorithm.Pbkdf2,
            Iterations = 210_000
        };

        var encoded = hasher.Hash("s3cret", options);

        Assert.True(hasher.Verify("s3cret", encoded));
        Assert.False(hasher.Verify("other", encoded));
    }

    [Fact]
    public void NeedsRehash_DetectsIterationChange()
    {
        var options = new PasswordHashOptions
        {
            Algorithm = PasswordHashAlgorithm.Pbkdf2,
            Iterations = 100_000
        };

        var encoded = hasher.Hash("s3cret", options);

        var higher = options with { Iterations = 150_000 };

        Assert.True(hasher.NeedsRehash(encoded, higher));
        Assert.False(hasher.NeedsRehash(encoded, options));
    }
}
