package auth

import (
	"bytes"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"strings"
	"sync"
	"testing"

	"golang.org/x/crypto/argon2"
)

func TestHashPasswordEncoding(t *testing.T) {
	const pw = "testPassword123"
	hash, err := HashPassword(pw)
	noErr(t, err, "HashPassword")

	parts := strings.Split(hash, "$")
	eq(t, len(parts), 6, "field count")
	eq(t, parts[0], "", "leading field")
	eq(t, parts[1], "argon2id", "algorithm")
	eq(t, parts[2], fmt.Sprintf("v=%d", argon2.Version), "version")
	eq(t, parts[3], fmt.Sprintf("m=%d,t=%d,p=%d", DefaultArgonMemory, DefaultArgonTime, DefaultArgonThreads), "parameters")

	salt, err := base64.RawStdEncoding.DecodeString(parts[4])
	noErr(t, err, "salt decode")
	eq(t, len(salt), DefaultArgonSaltLen, "salt length")

	digest, err := base64.RawStdEncoding.DecodeString(parts[5])
	noErr(t, err, "digest decode")
	eq(t, len(digest), DefaultArgonKeyLen, "digest length")

	// the encoded digest must be reproducible from the encoded material
	want := argon2.IDKey([]byte(pw), salt, DefaultArgonTime, DefaultArgonMemory, DefaultArgonThreads, DefaultArgonKeyLen)
	eqBytes(t, digest, want, "digest")

	isTrue(t, len(hash) <= MaxPHCHashLen, "default encoding within MaxPHCHashLen")
	noErr(t, ValidatePHCHashFormat(hash), "self-validation")
}

func TestHashPasswordSaltUniqueness(t *testing.T) {
	seen := make(map[string]struct{}, 64)
	for range 64 {
		h, err := HashPassword("testPassword123", cheapArgon...)
		noErr(t, err, "HashPassword")
		salt := strings.Split(h, "$")[4]
		if _, dup := seen[salt]; dup {
			t.Fatalf("duplicate salt: %s", salt)
		}
		seen[salt] = struct{}{}
	}
}

func TestVerifyPassword(t *testing.T) {
	const pw = "testPassword123"
	hash, err := HashPassword(pw, cheapArgon...)
	noErr(t, err, "HashPassword")

	noErr(t, VerifyPassword(pw, hash), "correct password")
	noErr(t, VerifyPassword(pw, hash), "repeat verification")

	for _, wrong := range []string{"wrongPassword", "", pw + "\x00", pw + " ", strings.ToUpper(pw)} {
		errIs(t, VerifyPassword(wrong, hash), ErrInvalidCredentials, fmt.Sprintf("password %q", wrong))
	}

	// verification has no minimum length: legacy hashes must stay verifiable
	weak := phcFor("short", []byte("0123456789abcdef"), DefaultArgonKeyLen)
	noErr(t, VerifyPassword("short", weak), "sub-minimum password verifies")
}

func TestPasswordLengthBounds(t *testing.T) {
	_, err := HashPassword("")
	errIs(t, err, ErrWeakPassword, "empty")
	_, err = HashPassword("1234567")
	errIs(t, err, ErrWeakPassword, "seven bytes")

	h8, err := HashPassword("12345678", cheapArgon...)
	noErr(t, err, "eight bytes")
	noErr(t, VerifyPassword("12345678", h8), "verify eight bytes")

	// the minimum is measured in bytes, not runes
	const multibyte = "ünïcödé"
	eq(t, len([]rune(multibyte)), 7, "rune count")
	eq(t, len(multibyte), 11, "byte count")
	hm, err := HashPassword(multibyte, cheapArgon...)
	noErr(t, err, "multibyte password")
	noErr(t, VerifyPassword(multibyte, hm), "verify multibyte")

	maxPw := strings.Repeat("a", MaxPasswordLen)
	hMax, err := HashPassword(maxPw, cheapArgon...)
	noErr(t, err, "maximum length")
	noErr(t, VerifyPassword(maxPw, hMax), "verify maximum length")

	_, err = HashPassword(maxPw+"a", cheapArgon...)
	errIs(t, err, ErrPasswordTooLong, "over maximum")
	// rejected before the KDF runs
	errIs(t, VerifyPassword(maxPw+"a", hMax), ErrPasswordTooLong, "verify over maximum")
}

func TestHashPasswordOptions(t *testing.T) {
	const pw = "testPassword123"

	h, err := HashPassword(pw, WithTime(2), WithMemory(16*1024), WithThreads(2))
	noErr(t, err, "custom parameters")
	eq(t, strings.Split(h, "$")[3], "m=16384,t=2,p=2", "encoded parameters")
	noErr(t, VerifyPassword(pw, h), "verify custom parameters")

	// zero values are discarded by the option guards
	h, err = HashPassword(pw, WithMemory(testArgonMemory), WithTime(0), WithThreads(0))
	noErr(t, err, "zero-valued options")
	eq(t, strings.Split(h, "$")[3],
		fmt.Sprintf("m=%d,t=%d,p=%d", testArgonMemory, DefaultArgonTime, DefaultArgonThreads),
		"defaults retained")

	// the last option wins
	h, err = HashPassword(pw, WithMemory(64*1024), WithMemory(testArgonMemory), WithTime(1), WithThreads(1))
	noErr(t, err, "repeated option")
	eq(t, strings.Split(h, "$")[3], fmt.Sprintf("m=%d,t=1,p=1", testArgonMemory), "last option applied")
}

func TestVerifyPasswordNonStandardDigestLength(t *testing.T) {
	// Records produced elsewhere may encode digests other than 32 bytes;
	// verification must derive at the encoded length.
	const pw = "testPassword123"
	salt := []byte("0123456789abcdef0123")

	for _, keyLen := range []uint32{16, 20, 32, MaxArgonKeyLen} {
		ctx := fmt.Sprintf("keyLen=%d", keyLen)
		h := phcFor(pw, salt, keyLen)
		noErr(t, ValidatePHCHashFormat(h), "format "+ctx)
		noErr(t, VerifyPassword(pw, h), "verify "+ctx)
		errIs(t, VerifyPassword("wrongPassword", h), ErrInvalidCredentials, "wrong password "+ctx)
	}
}

func TestValidatePHCHashFormat(t *testing.T) {
	ver := fmt.Sprintf("v=%d", argon2.Version)
	const params = "m=65536,t=3,p=4"
	okSalt, okDigest := rawB64(16), rawB64(32)

	build := func(alg, version, prm, salt, digest string) string {
		return "$" + alg + "$" + version + "$" + prm + "$" + salt + "$" + digest
	}
	std := func(prm, salt, digest string) string { return build("argon2id", ver, prm, salt, digest) }

	generated, err := HashPassword("testPassword123", cheapArgon...)
	noErr(t, err, "HashPassword")

	// largest structurally valid record: proves MaxPHCHashLen never binds
	maxRecord := std("m=4194304,t=1000,p=255", rawB64(MaxArgonSaltLen), rawB64(MaxArgonKeyLen))
	isTrue(t, len(maxRecord) <= MaxPHCHashLen, "maximum record within length cap")

	cases := []struct {
		name string
		hash string
		want error
	}{
		{"generated", generated, nil},
		{"minimal", std(params, okSalt, okDigest), nil},
		{"maximum record", maxRecord, nil},

		{"empty", "", ErrPHCInvalidFormat},
		{"plaintext", "plaintext", ErrPHCInvalidFormat},
		{"missing leading separator", "argon2id$" + ver + "$" + params + "$" + okSalt + "$" + okDigest, ErrPHCInvalidFormat},
		{"leading garbage", "x" + std(params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"leading space", " " + std(params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"too few fields", "$argon2id$" + ver + "$" + params, ErrPHCInvalidFormat},
		{"too many fields", std(params, okSalt, okDigest) + "$extra", ErrPHCInvalidFormat},
		{"over length cap", strings.Repeat("A", MaxPHCHashLen+1), ErrPHCInvalidFormat},

		{"algorithm bcrypt", build("bcrypt", ver, params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"algorithm argon2i", build("argon2i", ver, params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"algorithm argon2d", build("argon2d", ver, params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"algorithm case", build("ARGON2ID", ver, params, okSalt, okDigest), ErrPHCInvalidFormat},

		{"version empty", build("argon2id", "", params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"version malformed", build("argon2id", "version=19", params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"version leading zero", build("argon2id", "v=019", params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"version negative", build("argon2id", "v=-19", params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"version too low", build("argon2id", "v=18", params, okSalt, okDigest), ErrPHCInvalidFormat},
		{"version too high", build("argon2id", "v=20", params, okSalt, okDigest), ErrPHCInvalidFormat},

		{"parameters empty", std("", okSalt, okDigest), ErrPHCInvalidFormat},
		{"parameters reordered", std("t=3,m=65536,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"parameters spaced", std("m=65536, t=3, p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"parameters trailing", std("m=65536,t=3,p=4,x=1", okSalt, okDigest), ErrPHCInvalidFormat},
		{"parameters negative", std("m=-1,t=3,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"parameters overflow", std("m=99999999999999999999,t=3,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"zero time", std("m=65536,t=0,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"zero memory", std("m=0,t=3,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"zero threads", std("m=65536,t=3,p=0", okSalt, okDigest), ErrPHCInvalidFormat},
		{"memory at cap", std("m=4194304,t=3,p=4", okSalt, okDigest), nil},
		{"memory over cap", std("m=4194305,t=3,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"time at cap", std("m=65536,t=1000,p=4", okSalt, okDigest), nil},
		{"time over cap", std("m=65536,t=1001,p=4", okSalt, okDigest), ErrPHCInvalidFormat},
		{"threads at cap", std("m=65536,t=3,p=255", okSalt, okDigest), nil},
		{"threads overflow", std("m=65536,t=3,p=256", okSalt, okDigest), ErrPHCInvalidFormat},

		{"salt not base64", std(params, "!!!invalid!!!", okDigest), ErrPHCInvalidSalt},
		{"salt padded", std(params, base64.StdEncoding.EncodeToString(make([]byte, 10)), okDigest), ErrPHCInvalidSalt},
		{"salt url alphabet", std(params, "abc-def_ghijklmn", okDigest), ErrPHCInvalidSalt},
		{"salt empty", std(params, "", okDigest), ErrPHCInvalidSalt},
		{"salt too short", std(params, rawB64(7), okDigest), ErrPHCInvalidSalt},
		{"salt minimum", std(params, rawB64(8), okDigest), nil},
		{"salt at cap", std(params, rawB64(MaxArgonSaltLen), okDigest), nil},
		{"salt over cap", std(params, rawB64(MaxArgonSaltLen+1), okDigest), ErrPHCInvalidSalt},

		{"digest not base64", std(params, okSalt, "!!!invalid!!!"), ErrPHCInvalidHash},
		{"digest empty", std(params, okSalt, ""), ErrPHCInvalidHash},
		{"digest too short", std(params, okSalt, rawB64(15)), ErrPHCInvalidHash},
		{"digest minimum", std(params, okSalt, rawB64(16)), nil},
		{"digest at cap", std(params, okSalt, rawB64(MaxArgonKeyLen)), nil},
		{"digest over cap", std(params, okSalt, rawB64(MaxArgonKeyLen+1)), ErrPHCInvalidHash},

		// encoding/base64 discards CR and LF, so PHC records are not
		// byte-canonical: never compare them as strings.
		{"digest with newline", std(params, okSalt, okDigest[:20]+"\n"+okDigest[20:]), nil},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			err := ValidatePHCHashFormat(tc.hash)
			if tc.want == nil {
				noErr(t, err, tc.name)
				return
			}
			errIs(t, err, tc.want, tc.name)
		})
	}
}

func TestVerifyPasswordMalformedNoPanic(t *testing.T) {
	for _, h := range []string{
		"", "$", "$$$$$", "$argon2id$", strings.Repeat("$", 1000),
		"$argon2id$v=19$m=65536,t=0,p=4$" + rawB64(16) + "$" + rawB64(32),
		"$argon2id$v=19$m=65536,t=3,p=0$" + rawB64(16) + "$" + rawB64(32),
		"$argon2id$v=19$garbage$" + rawB64(16) + "$" + rawB64(32),
		"$argon2id$v=19$m=65536,t=3,p=4$$",
		"$argon2id$v=19$m=99999999999999999999,t=3,p=4$" + rawB64(16) + "$" + rawB64(32),
	} {
		hasErr(t, VerifyPassword("whatever", h), fmt.Sprintf("hash %q", h))
	}
}

func TestMigrateFromPHC(t *testing.T) {
	const user, pw = "migrationUser", "testPassword123"
	phcHash, err := HashPassword(pw, cheapArgon...)
	noErr(t, err, "HashPassword")

	cred, err := MigrateFromPHC(user, pw, phcHash)
	noErr(t, err, "MigrateFromPHC")
	eq(t, cred.Username, user, "username")
	eq(t, cred.ArgonTime, uint32(testArgonTime), "time")
	eq(t, cred.ArgonMemory, uint32(testArgonMemory), "memory")
	eq(t, cred.ArgonThreads, uint8(testArgonThreads), "threads")
	eq(t, len(cred.StoredKey), sha256.Size, "stored key length")
	eq(t, len(cred.ServerKey), sha256.Size, "server key length")

	salt, err := base64.RawStdEncoding.DecodeString(strings.Split(phcHash, "$")[4])
	noErr(t, err, "salt decode")
	eqBytes(t, cred.Salt, salt, "salt carried over")

	// migration must agree with direct derivation over the same material
	direct, err := DeriveCredential(user, pw, cred.Salt, cred.ArgonTime, cred.ArgonMemory, cred.ArgonThreads)
	noErr(t, err, "DeriveCredential")
	eqBytes(t, cred.StoredKey, direct.StoredKey, "stored key")
	eqBytes(t, cred.ServerKey, direct.ServerKey, "server key")

	// keys are derived from the salted password, not copies of it
	salted, err := base64.RawStdEncoding.DecodeString(strings.Split(phcHash, "$")[5])
	noErr(t, err, "digest decode")
	want := sha256.Sum256(computeHMAC(salted, []byte("Client Key")))
	eqBytes(t, cred.StoredKey, want[:], "stored key derivation")
	eqBytes(t, cred.ServerKey, computeHMAC(salted, []byte("Server Key")), "server key derivation")
	if bytes.Equal(cred.StoredKey, salted) || bytes.Equal(cred.ServerKey, salted) {
		t.Fatal("credential exposes the salted password")
	}

	_, err = MigrateFromPHC(user, "wrongPassword", phcHash)
	errIs(t, err, ErrInvalidCredentials, "wrong password")
	_, err = MigrateFromPHC(user, pw, "$invalid$format")
	errIs(t, err, ErrPHCInvalidFormat, "malformed record")
	_, err = MigrateFromPHC(user, strings.Repeat("a", MaxPasswordLen+1), phcHash)
	errIs(t, err, ErrPasswordTooLong, "oversized password")
}

func TestMigrateFromPHCShortSalt(t *testing.T) {
	// parsePHC accepts 8..64 byte salts; SCRAM requires >= 16. The 32-byte
	// digest branch skips that check, the fallback branch enforces it.
	// See the ‼️ note on MigrateFromPHC.
	const pw = "testPassword123"
	salt := []byte("12345678")

	cred, err := MigrateFromPHC("u", pw, phcFor(pw, salt, DefaultArgonKeyLen))
	noErr(t, err, "32-byte digest branch")
	eq(t, len(cred.Salt), 8, "short salt retained")

	// the credential it produced cannot survive an export/import cycle
	_, err = ImportCredential(cred.Export())
	errIs(t, err, ErrSCRAMSaltTooShort, "re-import")

	_, err = MigrateFromPHC("u", pw, phcFor(pw, salt, 20))
	errIs(t, err, ErrSCRAMSaltTooShort, "fallback branch")
}

func TestConcurrentPasswordOperations(t *testing.T) {
	const pw = "testPassword123"
	hash, err := HashPassword(pw, cheapArgon...)
	noErr(t, err, "HashPassword")

	const n = 16
	errs := make(chan error, 2*n)
	var wg sync.WaitGroup
	for i := range n {
		wg.Add(1)
		go func() {
			defer wg.Done()
			if err := VerifyPassword(pw, hash); err != nil {
				errs <- err
			}
			local := fmt.Sprintf("password-%04d", i)
			h, err := HashPassword(local, cheapArgon...)
			if err != nil {
				errs <- err
				return
			}
			if err := VerifyPassword(local, h); err != nil {
				errs <- err
			}
		}()
	}
	wg.Wait()
	close(errs)
	for err := range errs {
		t.Errorf("concurrent operation: %v", err)
	}
}

func FuzzParsePHC(f *testing.F) {
	h, err := HashPassword("testPassword123", cheapArgon...)
	if err != nil {
		f.Fatal(err)
	}
	f.Add(h)
	f.Add("")
	f.Add("$argon2id$v=19$m=65536,t=3,p=4$" + rawB64(16) + "$" + rawB64(32))
	f.Add("$argon2id$v=19$m=0,t=0,p=0$$")

	f.Fuzz(func(t *testing.T, s string) {
		r, err := parsePHC(s)
		if err != nil {
			if r != nil {
				t.Fatalf("result returned alongside error: %v", err)
			}
			return
		}
		if r.time == 0 || r.memory == 0 || r.threads == 0 {
			t.Fatalf("zero parameter accepted: m=%d t=%d p=%d", r.memory, r.time, r.threads)
		}
		if r.memory > 4*1024*1024 || r.time > 1000 {
			t.Fatalf("cost bound exceeded: m=%d t=%d", r.memory, r.time)
		}
		if len(r.salt) < 8 || len(r.salt) > MaxArgonSaltLen {
			t.Fatalf("salt length %d accepted", len(r.salt))
		}
		if len(r.expectedHash) < 16 || len(r.expectedHash) > MaxArgonKeyLen {
			t.Fatalf("digest length %d accepted", len(r.expectedHash))
		}
	})
}

func FuzzVerifyPassword(f *testing.F) {
	h, err := HashPassword("testPassword123", cheapArgon...)
	if err != nil {
		f.Fatal(err)
	}
	f.Add("testPassword123", h)
	f.Add("", "")
	f.Add("x", "$argon2id$v=19$m=8192,t=1,p=1$"+rawB64(16)+"$"+rawB64(32))

	f.Fuzz(func(t *testing.T, password, hash string) {
		// parsePHC admits m up to 4 GiB from untrusted input; clamp before
		// letting the fuzzer choose the KDF cost.
		if r, err := parsePHC(hash); err == nil &&
			(r.memory > 64*1024 || r.time > 4 || r.threads > 8) {
			return
		}
		_ = VerifyPassword(password, hash)
	})
}

func BenchmarkHashPasswordDefault(b *testing.B) {
	for b.Loop() {
		if _, err := HashPassword("testPassword123"); err != nil {
			b.Fatal(err)
		}
	}
}

func BenchmarkVerifyPasswordDefault(b *testing.B) {
	hash, err := HashPassword("testPassword123")
	if err != nil {
		b.Fatal(err)
	}
	for b.Loop() {
		if err := VerifyPassword("testPassword123", hash); err != nil {
			b.Fatal(err)
		}
	}
}

func TestVerifyPasswordCostCeiling(t *testing.T) {
	const pw = "testPassword123"
	// well-formed per PHC, refused before the KDF runs
	over := fmt.Sprintf("$argon2id$v=%d$m=%d,t=1,p=1$%s$%s",
		argon2.Version, MaxVerifyArgonMemory+1, rawB64(16), rawB64(32))
	noErr(t, ValidatePHCHashFormat(over), "format validation is unaffected")
	errIs(t, VerifyPassword(pw, over), ErrPHCCostTooHigh, "memory over ceiling")

	overTime := fmt.Sprintf("$argon2id$v=%d$m=8192,t=%d,p=1$%s$%s",
		argon2.Version, MaxVerifyArgonTime+1, rawB64(16), rawB64(32))
	errIs(t, VerifyPassword(pw, overTime), ErrPHCCostTooHigh, "time over ceiling")
	_, err := MigrateFromPHC("u", pw, over)
	errIs(t, err, ErrPHCCostTooHigh, "migration honors the ceiling")
}