from pygitweb.password_hash import hash_password, is_password_hash, verify_password


def test_hash_and_verify_roundtrip() -> None:
	stored = hash_password("secret-password", config_salt="a1b2c3d4e5f67890")
	assert stored.startswith("scrypt$131072$8$1$")
	assert verify_password("secret-password", stored, config_salt="a1b2c3d4e5f67890")
	assert not verify_password("wrong", stored, config_salt="a1b2c3d4e5f67890")


def test_verify_legacy_hash_without_config_salt() -> None:
	stored = hash_password("legacy")
	assert verify_password("legacy", stored, config_salt="0123456789abcdef")


def test_is_password_hash_rejects_malformed_values() -> None:
	assert is_password_hash(hash_password("secret"))
	assert not is_password_hash("plaintext")
	assert not is_password_hash("scrypt$nope$8$1$aaaa$bbbb")
	assert not is_password_hash("scrypt$131072$8$1$!!!$!!!")


def test_verify_rejects_weak_parameters() -> None:
	stored = hash_password("x")
	parts = stored.split("$")
	parts[1] = "65536"
	assert not verify_password("x", "$".join(parts))