package security

import (
	"bytes"
	"crypto/rand"
	"testing"
)

func TestSealOpenRoundTrip(t *testing.T) {
	key := make([]byte, AESKeySize)
	if _, err := rand.Read(key); err != nil {
		t.Fatalf("rand: %v", err)
	}
	secret, _ := GenerateSecret()

	ct, nonce, err := SealSecret(key, secret)
	if err != nil {
		t.Fatalf("SealSecret: %v", err)
	}
	if bytes.Equal(ct, secret) {
		t.Fatal("ciphertext equals plaintext")
	}
	got, err := OpenSecret(key, ct, nonce)
	if err != nil {
		t.Fatalf("OpenSecret: %v", err)
	}
	if !bytes.Equal(got, secret) {
		t.Fatal("round trip did not recover the secret")
	}
}

func TestOpenRejectsWrongKey(t *testing.T) {
	key := make([]byte, AESKeySize)
	rand.Read(key)
	other := make([]byte, AESKeySize)
	rand.Read(other)
	secret, _ := GenerateSecret()

	ct, nonce, _ := SealSecret(key, secret)
	if _, err := OpenSecret(other, ct, nonce); err == nil {
		t.Fatal("OpenSecret accepted a wrong key")
	}
}

func TestSealRejectsWrongKeySize(t *testing.T) {
	if _, _, err := SealSecret(make([]byte, 16), []byte("x")); err == nil {
		t.Fatal("SealSecret accepted a 16 byte key")
	}
}