import pytest

from src.application.auth.keys import generate_api_key, hash_secret, parse_api_key, verify_secret

pytestmark = pytest.mark.unit


def test_generate_api_key_round_trips_through_parse() -> None:
    key_prefix, secret, full_key = generate_api_key()

    parsed = parse_api_key(full_key)

    assert parsed == (key_prefix, secret)


def test_generate_api_key_produces_unique_secrets() -> None:
    _, secret_a, _ = generate_api_key()
    _, secret_b, _ = generate_api_key()

    assert secret_a != secret_b


@pytest.mark.parametrize(
    "malformed",
    ["", "sk_onlyprefix", "wrongscheme_prefix_secret", "sk__secret", "sk_prefix_"],
)
def test_parse_api_key_rejects_malformed_input(malformed: str) -> None:
    assert parse_api_key(malformed) is None


def test_verify_secret_accepts_matching_secret() -> None:
    _, secret, _ = generate_api_key()

    assert verify_secret(secret, hash_secret(secret))


def test_verify_secret_rejects_wrong_secret() -> None:
    assert not verify_secret("wrong-secret", hash_secret("correct-secret"))