# #region Test.AuthSecurity [C:3] [TYPE Module] [SEMANTICS test,auth,security,bcrypt,password]
# @BRIEF Tests for core/auth/security.py — verify_password, get_password_hash.
# @RELATION BINDS_TO -> [AuthSecurityModule]

from pathlib import Path
import sys

sys.path.insert(0, str(Path(__file__).parent.parent.parent / "src"))

from unittest.mock import MagicMock, patch
import pytest


# #region test_get_password_hash [C:2] [TYPE Function]
# @BRIEF Test get_password_hash generates valid bcrypt hashes.
class TestGetPasswordHash:
    def test_returns_bcrypt_hash(self):
        from src.core.auth.security import get_password_hash
        hashed = get_password_hash("my-password")
        assert isinstance(hashed, str)
        assert hashed.startswith("$2b$") or hashed.startswith("$2a$")

    def test_different_hash_each_call(self):
        from src.core.auth.security import get_password_hash
        h1 = get_password_hash("same-password")
        h2 = get_password_hash("same-password")
        assert h1 != h2  # bcrypt gensalt produces different salts
# #endregion test_get_password_hash


# #region test_verify_password [C:2] [TYPE Function]
# @BRIEF Test verify_password for correct and incorrect passwords.
class TestVerifyPassword:
    def test_verifies_correct_password(self):
        from src.core.auth.security import get_password_hash, verify_password
        hashed = get_password_hash("correct-password")
        assert verify_password("correct-password", hashed) is True

    def test_rejects_incorrect_password(self):
        from src.core.auth.security import get_password_hash, verify_password
        hashed = get_password_hash("correct-password")
        assert verify_password("wrong-password", hashed) is False

    def test_returns_false_for_empty_hash(self):
        from src.core.auth.security import verify_password
        assert verify_password("any-password", "") is False

    def test_returns_false_for_none_hash(self):
        from src.core.auth.security import verify_password
        assert verify_password("any-password", None) is False  # type: ignore

    def test_returns_false_on_exception(self):
        from src.core.auth.security import verify_password
        with patch("src.core.auth.security.bcrypt.checkpw", side_effect=Exception("error")):
            assert verify_password("pwd", "hash") is False

    def test_handles_unicode_passwords(self):
        from src.core.auth.security import get_password_hash, verify_password
        hashed = get_password_hash("pässwörd-你好")
        assert verify_password("pässwörd-你好", hashed) is True
        assert verify_password("wrong", hashed) is False
# #endregion test_verify_password
# #endregion Test.AuthSecurity
