package main

import (
	"testing"
)

func TestPasswordHashAndVerify(t *testing.T) {
	hash, err := HashPassword("correct horse battery staple")
	if err != nil {
		t.Fatal(err)
	}
	if hash == "correct horse battery staple" {
		t.Fatal("password stored in plaintext")
	}
	if !VerifyPassword(hash, "correct horse battery staple") {
		t.Fatal("correct password rejected")
	}
	if VerifyPassword(hash, "wrong password") {
		t.Fatal("wrong password accepted")
	}
	if VerifyPassword("malformed", "correct horse battery staple") {
		t.Fatal("malformed hash accepted")
	}
}

func TestRBAC(t *testing.T) {
	if !permits(RoleAdministrator, RoleOperator) {
		t.Fatal("administrator must inherit operator")
	}
	if permits(RoleViewer, RoleOperator) {
		t.Fatal("viewer must not mutate")
	}
	if !permits(RoleOperator, RoleViewer) {
		t.Fatal("operator must read")
	}
	if permits("unknown", RoleViewer) {
		t.Fatal("unknown role allowed")
	}
}

func TestUsernameValidation(t *testing.T) {
	for _, value := range []string{"admin", "ops.user", "alice-2"} {
		if !validUsername(value) {
			t.Fatalf("valid username rejected: %s", value)
		}
	}
	for _, value := range []string{"x", "admin@example", "../../root"} {
		if validUsername(value) {
			t.Fatalf("invalid username accepted: %s", value)
		}
	}
}