from app.auth import security


def test_password_hash_roundtrip():
    hashed = security.hash_password("s3cret!")
    assert security.verify_password("s3cret!", hashed)
    assert not security.verify_password("wrong", hashed)


def test_jwt_roundtrip(monkeypatch):
    monkeypatch.setattr(security.settings, "jwt_secret", "test-secret")
    token = security.create_access_token(user_id=42)
    assert security.decode_access_token(token) == 42