package security

import (
	"bytes"
	"testing"
)

func TestSessionTokenHashMatches(t *testing.T) {
	token, hash, err := NewSessionToken()
	if err != nil {
		t.Fatalf("NewSessionToken: %v", err)
	}
	if token == "" {
		t.Fatal("empty token")
	}
	if !bytes.Equal(hash, HashSessionToken(token)) {
		t.Fatal("returned hash does not match HashSessionToken(token)")
	}
}

func TestSessionTokensAreUnique(t *testing.T) {
	seen := make(map[string]bool)
	for i := 0; i < 100; i++ {
		token, _, err := NewSessionToken()
		if err != nil {
			t.Fatalf("NewSessionToken: %v", err)
		}
		if seen[token] {
			t.Fatal("duplicate session token")
		}
		seen[token] = true
	}
}

func TestRecoveryCodesGenerated(t *testing.T) {
	codes, err := GenerateRecoveryCodes(10)
	if err != nil {
		t.Fatalf("GenerateRecoveryCodes: %v", err)
	}
	if len(codes) != 10 {
		t.Fatalf("got %d codes, want 10", len(codes))
	}
	seen := make(map[string]bool)
	for _, c := range codes {
		if c == "" {
			t.Fatal("empty recovery code")
		}
		if seen[c] {
			t.Fatal("duplicate recovery code")
		}
		seen[c] = true
	}
}

func TestTaggerDeterministicAndBound(t *testing.T) {
	tagger, err := NewTagger([]byte("server lookup key"))
	if err != nil {
		t.Fatalf("NewTagger: %v", err)
	}
	a := tagger.Tag("ABC123")
	b := tagger.Tag("ABC123")
	if !tagger.Equal(a, b) {
		t.Fatal("tag for the same value differs")
	}
	if tagger.Equal(a, tagger.Tag("different")) {
		t.Fatal("tag collided across different values")
	}

	other, _ := NewTagger([]byte("a different server key"))
	if tagger.Equal(a, other.Tag("ABC123")) {
		t.Fatal("tag matched under a different key")
	}
}