from app.auth import security


def test_password_hash_roundtrip():
    hashed = security.hash_password("s3cret!")
    assert security.verify_password("s3cret!", hashed)
    assert not security.verify_password("wrong", hashed)


def test_jwt_roundtrip(monkeypatch):
    monkeypatch.setattr(security.settings, "jwt_secret", "test-secret")
    token = security.create_access_token(user_id=42)
    assert security.decode_access_token(token) == 42


def test_verify_password_returns_false_for_an_unparseable_hash():
    """B-13: only VerifyMismatchError was caught, so a corrupted stored hash raised
    InvalidHashError and became an unhandled 500 on the login endpoint instead of a
    plain "wrong credentials" 401."""
    from app.auth.security import verify_password

    assert verify_password("whatever", "not-an-argon2-hash") is False
    assert verify_password("whatever", "") is False


def test_verify_password_still_rejects_a_wrong_password():
    from app.auth.security import hash_password, verify_password

    stored = hash_password("correct-horse-battery")
    assert verify_password("correct-horse-battery", stored) is True
    assert verify_password("wrong", stored) is False