from thoughtsync.security import generate_token, hash_password, hash_token, verify_password


def test_password_roundtrip():
    h = hash_password("correct horse battery staple")
    assert verify_password("correct horse battery staple", h)
    assert not verify_password("wrong password", h)


def test_hash_token_deterministic():
    t = generate_token()
    # Lookup hash is deterministic (same token → same hash) and SHA-256 hex (64 chars).
    assert hash_token(t) == hash_token(t)
    assert len(hash_token(t)) == 64
    # Different tokens hash differently.
    assert hash_token(t) != hash_token(generate_token())


def test_generate_token_unique():
    assert generate_token() != generate_token()
    assert len(generate_token()) >= 32


def test_password_hash_is_salted():
    # Same input hashes differently each time (random salt).
    assert hash_password("same-input") != hash_password("same-input")


def test_verify_rejects_garbage_hash():
    assert not verify_password("whatever", "not-a-bcrypt-hash")