import { describe, expect, it } from "vitest";
import {
  checkPasswordPolicy,
  csrfTokenFor,
  hashPassword,
  lockoutDurationMs,
  newSessionToken,
  RateLimiter,
  verifyCsrf,
  verifyPassword,
} from "./index.js";

describe("auth primitives", () => {
  it("hashes with argon2id and verifies", async () => {
    const h = await hashPassword("admin123");
    expect(h.startsWith("$argon2id$")).toBe(true);
    expect(await verifyPassword(h, "admin123")).toBe(true);
    expect(await verifyPassword(h, "admin124")).toBe(false);
    expect(await verifyPassword("garbage", "admin123")).toBe(false);
  });

  it("rejects weak passwords incl. the bootstrap one", () => {
    expect(checkPasswordPolicy("admin123").ok).toBe(false);
    expect(checkPasswordPolicy("Admin123456!x", "admin").ok).toBe(false);
    expect(checkPasswordPolicy("Correct-Horse-9-Battery").ok).toBe(true);
  });

  it("csrf tokens bind to the session", () => {
    const { tokenHash } = newSessionToken();
    const t = csrfTokenFor("secret", tokenHash);
    expect(verifyCsrf("secret", tokenHash, t)).toBe(true);
    expect(verifyCsrf("secret", tokenHash, `${t}x`)).toBe(false);
    expect(verifyCsrf("other", tokenHash, t)).toBe(false);
  });

  it("rate limiter and lockout", () => {
    const rl = new RateLimiter(2, 1000);
    expect(rl.check("a").allowed).toBe(true);
    expect(rl.check("a").allowed).toBe(true);
    expect(rl.check("a").allowed).toBe(false);
    expect(lockoutDurationMs(4)).toBe(0);
    expect(lockoutDurationMs(5)).toBe(60_000);
    expect(lockoutDurationMs(20)).toBe(3_600_000);
  });
});