from pygitweb.password_hash import hash_password, is_password_hash, verify_password


def test_hash_and_verify_roundtrip() -> None:
    stored = hash_password("secret-password", config_salt="a1b2c3d4e5f67890")
    assert stored.startswith("scrypt$131072$8$1$")
    assert verify_password("secret-password", stored, config_salt="a1b2c3d4e5f67890")
    assert not verify_password("wrong", stored, config_salt="a1b2c3d4e5f67890")


def test_verify_legacy_hash_without_config_salt() -> None:
    stored = hash_password("legacy")
    assert verify_password("legacy", stored, config_salt="0123456789abcdef")


def test_is_password_hash_rejects_malformed_values() -> None:
    assert is_password_hash(hash_password("secret"))
    assert not is_password_hash("plaintext")
    assert not is_password_hash("scrypt$nope$8$1$aaaa$bbbb")
    assert not is_password_hash("scrypt$131072$8$1$!!!$!!!")


def test_verify_rejects_weak_parameters() -> None:
    stored = hash_password("x")
    parts = stored.split("$")
    parts[1] = "65536"
    assert not verify_password("x", "$".join(parts))