from app.security.passwords import hash_password, verify_password
from app.security.totp import (
    decrypt_totp_secret,
    encrypt_totp_secret,
    generate_totp_secret,
    verify_totp_code,
)
import pyotp


def test_password_hash_roundtrip():
    h = hash_password("Sup3rSecret!Passphrase")
    assert verify_password(h, "Sup3rSecret!Passphrase")
    assert not verify_password(h, "wrong-password")


def test_totp_secret_encryption_roundtrip():
    secret = generate_totp_secret()
    enc = encrypt_totp_secret(secret)
    assert enc != secret.encode()
    assert decrypt_totp_secret(enc) == secret


def test_totp_verification():
    secret = generate_totp_secret()
    code = pyotp.TOTP(secret).now()
    assert verify_totp_code(secret, code)
    assert not verify_totp_code(secret, "000000") or pyotp.TOTP(secret).now() == "000000"