import test from 'node:test';
import assert from 'node:assert/strict';
import {
  hashPassword, verifyPassword, newToken, hashSessionToken,
  pupilPassword, staffPassword, checkPassword, sessionDaysForRole,
} from '../src/auth.js';

test('wachtwoordhash verifieert alleen het juiste wachtwoord', async () => {
  const hash = await hashPassword('Veilig123');
  assert.equal(await verifyPassword('Veilig123', hash), true);
  assert.equal(await verifyPassword('verkeerd', hash), false);
  assert.equal(hash.includes('Veilig123'), false);
});

test('sessietokens zijn sterk en worden gehasht opgeslagen', () => {
  const token = newToken();
  assert.match(token, /^[a-f0-9]{64}$/);
  assert.match(hashSessionToken(token), /^[a-f0-9]{64}$/);
  assert.notEqual(hashSessionToken(token), token);
});

test('gegenereerde wachtwoorden voldoen aan het beleid', () => {
  const pupil = pupilPassword();
  const staff = staffPassword();
  assert.equal(checkPassword(pupil, 'pupil'), null);
  assert.equal(checkPassword(staff, 'teacher'), null);
  assert.match(pupil, /^[a-z]+-[a-z]+-[a-z]+-\d{3}$/);
  assert.ok(staff.length >= 14);
});

test('sessieduur wordt korter bij meer privileges', () => {
  assert.equal(sessionDaysForRole('super'), 1);
  assert.equal(sessionDaysForRole('admin'), 1);
  assert.equal(sessionDaysForRole('teacher'), 7);
  assert.equal(sessionDaysForRole('pupil'), 30);
});