"""Crypto primitives — a guard for the cryptography (Fernet) + argon2 dependency bumps.

Added with the cryptography 46->50 CVE bump: encrypt/decrypt/decrypt_optional had NO test, and they are
the token-at-rest path (Google/API/SMTP/Plex secrets in system_config, OAuth refresh tokens). A fresh
Fernet key is monkeypatched in so the test doesn't depend on TOKEN_ENCRYPTION_KEY being set in the env.
Pure-logic (no DB).
"""

from cryptography.fernet import Fernet

from app import security


def test_fernet_encrypt_decrypt_roundtrip(monkeypatch):
    monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
    assert security.decrypt(security.encrypt("hunter2")) == "hunter2"
    assert security.encrypt(None) is None
    assert security.decrypt(None) is None


def test_decrypt_optional_degrades_instead_of_raising(monkeypatch):
    # Garbage / absent input -> None (never raises).
    monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
    assert security.decrypt_optional("not-a-valid-token") is None
    assert security.decrypt_optional(None) is None
    # And a ciphertext written under a DIFFERENT key (the TOKEN_ENCRYPTION_KEY-mismatch case that B-core-2
    # made non-fatal) also degrades to None rather than raising InvalidToken.
    ciphertext = security.encrypt("secret")
    monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))  # rotate the key
    assert security.decrypt_optional(ciphertext) is None


def test_password_hash_and_verify_roundtrip():
    hashed = security.hash_password("correct horse battery")
    assert security.verify_password("correct horse battery", hashed) is True
    assert security.verify_password("wrong password", hashed) is False
    assert security.verify_password("anything", None) is False