/**
 * Password Security Tests
 * Tests for password hashing, validation, strength requirements, and timing attacks
 */

import { describe, it, expect } from "bun:test";
import {
  hashPassword,
  checkPassword,
  checkPasswordSafe
} from "~/server/password";
import { validatePassword, passwordsMatch } from "~/lib/validation";
import { measureTime } from "./test-utils";

describe("Password Security", () => {
  describe("Password Hashing", () => {
    it("should hash passwords using bcrypt", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      expect(hash).toBeDefined();
      expect(typeof hash).toBe("string");
      // Bcrypt hashes start with $2b$ or $2a$
      expect(hash).toMatch(/^\$2[ab]\$/);
    });

    it("should generate unique hashes for same password", async () => {
      const password = "TestPassword123!";
      const hash1 = await hashPassword(password);
      const hash2 = await hashPassword(password);

      expect(hash1).not.toBe(hash2);
    });

    it("should generate hashes with sufficient length", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      // Bcrypt hashes are 60 characters long
      expect(hash.length).toBe(60);
    });

    it("should handle very long passwords", async () => {
      const longPassword = "a".repeat(1000);
      const hash = await hashPassword(longPassword);

      expect(hash).toBeDefined();
      expect(hash.length).toBe(60);
    });

    it("should handle passwords with special characters", async () => {
      const specialPassword = "P@ssw0rd!#$%^&*()_+-=[]{}|;:',.<>?/~`";
      const hash = await hashPassword(specialPassword);

      expect(hash).toBeDefined();
      const match = await checkPassword(specialPassword, hash);
      expect(match).toBe(true);
    });

    it("should handle passwords with unicode characters", async () => {
      const unicodePassword = "Pässwörd123🔐🛡️";
      const hash = await hashPassword(unicodePassword);

      expect(hash).toBeDefined();
      const match = await checkPassword(unicodePassword, hash);
      expect(match).toBe(true);
    });

    it("should handle empty passwords", async () => {
      const emptyPassword = "";
      const hash = await hashPassword(emptyPassword);

      expect(hash).toBeDefined();
      expect(hash.length).toBe(60);
    });
  });

  describe("Password Verification", () => {
    it("should verify correct password", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);
      const match = await checkPassword(password, hash);

      expect(match).toBe(true);
    });

    it("should reject incorrect password", async () => {
      const password = "TestPassword123!";
      const wrongPassword = "WrongPassword123!";
      const hash = await hashPassword(password);
      const match = await checkPassword(wrongPassword, hash);

      expect(match).toBe(false);
    });

    it("should be case-sensitive", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);
      const match = await checkPassword("testpassword123!", hash);

      expect(match).toBe(false);
    });

    it("should detect single character differences", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);
      const almostMatch = "TestPassword124!";
      const match = await checkPassword(almostMatch, hash);

      expect(match).toBe(false);
    });

    it("should reject password with extra characters", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);
      const match = await checkPassword(password + "x", hash);

      expect(match).toBe(false);
    });

    it("should reject password missing characters", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);
      const match = await checkPassword(password.slice(0, -1), hash);

      expect(match).toBe(false);
    });
  });

  describe("Timing Attack Prevention", () => {
    it("should use constant time comparison in checkPasswordSafe", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      // Measure time for correct password
      const { duration: correctDuration } = await measureTime(() =>
        checkPasswordSafe(password, hash)
      );

      // Measure time for incorrect password
      const { duration: incorrectDuration } = await measureTime(() =>
        checkPasswordSafe("WrongPassword123!", hash)
      );

      // Bcrypt comparison should take similar time regardless
      const timingDifference = Math.abs(correctDuration - incorrectDuration);

      // Allow reasonable variance (bcrypt is inherently slow)
      expect(timingDifference).toBeLessThan(50);
    });

    it("should handle null hash without timing leak", async () => {
      const password = "TestPassword123!";

      // Measure time for null hash
      const { result: result1, duration: duration1 } = await measureTime(() =>
        checkPasswordSafe(password, null)
      );

      // Measure time for undefined hash
      const { result: result2, duration: duration2 } = await measureTime(() =>
        checkPasswordSafe(password, undefined)
      );

      expect(result1).toBe(false);
      expect(result2).toBe(false);

      // Should take similar time
      const timingDifference = Math.abs(duration1 - duration2);
      expect(timingDifference).toBeLessThan(50);
    });

    it("should run bcrypt even when user doesn't exist", async () => {
      const password = "TestPassword123!";

      // checkPasswordSafe should always run bcrypt to prevent timing attacks
      const { duration } = await measureTime(() =>
        checkPasswordSafe(password, null)
      );

      // Should take at least a few milliseconds (bcrypt is slow)
      expect(duration).toBeGreaterThan(1);
    });

    it("should have consistent timing for user exists vs not exists", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      // User exists
      const { duration: existsDuration } = await measureTime(() =>
        checkPasswordSafe("WrongPassword", hash)
      );

      // User doesn't exist (null hash)
      const { duration: notExistsDuration } = await measureTime(() =>
        checkPasswordSafe("WrongPassword", null)
      );

      // Timing should be similar to prevent user enumeration
      const timingDifference = Math.abs(existsDuration - notExistsDuration);
      expect(timingDifference).toBeLessThan(50);
    });
  });

  describe("Password Validation", () => {
    it("should accept strong passwords", () => {
      const strongPassword = "MyStr0ng!P@ssw0rd";
      const result = validatePassword(strongPassword);

      expect(result.isValid).toBe(true);
      expect(result.errors).toHaveLength(0);
      expect(result.strength).toBe("good");
    });

    it("should reject passwords shorter than 12 characters", () => {
      const shortPassword = "Short1!";
      const result = validatePassword(shortPassword);

      expect(result.isValid).toBe(false);
      expect(result.errors).toContain(
        "Password must be at least 12 characters long"
      );
    });

    it("should reject passwords without uppercase letters", () => {
      const noUppercase = "lowercase123!@#";
      const result = validatePassword(noUppercase);

      expect(result.isValid).toBe(false);
      expect(result.errors).toContain(
        "Password must contain at least one uppercase letter"
      );
    });

    it("should reject passwords without lowercase letters", () => {
      const noLowercase = "UPPERCASE123!@#";
      const result = validatePassword(noLowercase);

      expect(result.isValid).toBe(false);
      expect(result.errors).toContain(
        "Password must contain at least one lowercase letter"
      );
    });

    it("should reject passwords without numbers", () => {
      const noNumbers = "NoNumbersHere!@#";
      const result = validatePassword(noNumbers);

      expect(result.isValid).toBe(false);
      expect(result.errors).toContain(
        "Password must contain at least one number"
      );
    });

    it("should reject passwords without special characters", () => {
      const noSpecial = "NoSpecialChars123";
      const result = validatePassword(noSpecial);

      expect(result.isValid).toBe(false);
      expect(result.errors).toContain(
        "Password must contain at least one special character"
      );
    });

    it("should reject common weak passwords", () => {
      const commonPatterns = [
        "Password123!",
        "Qwerty123456!",
        "Letmein12345!",
        "Welcome123!@"
      ];

      for (const password of commonPatterns) {
        const result = validatePassword(password);
        expect(result.isValid).toBe(false);
        expect(result.errors.some((e) => e.includes("common patterns"))).toBe(
          true
        );
      }
    });

    it("should calculate password strength correctly", () => {
      const fairPassword = "MyP@ssw0rd12"; // 12 chars
      const goodPassword = "MyStr0ng!P@ssw0rd"; // 17 chars
      const strongPassword = "MyV3ry!Str0ng@P@ssw0rd123"; // 25 chars

      expect(validatePassword(fairPassword).strength).toBe("fair");
      expect(validatePassword(goodPassword).strength).toBe("good");
      expect(validatePassword(strongPassword).strength).toBe("strong");
    });

    it("should mark weak passwords appropriately", () => {
      const weakPassword = "weak";
      const result = validatePassword(weakPassword);

      expect(result.strength).toBe("weak");
      expect(result.isValid).toBe(false);
    });
  });

  describe("Password Matching", () => {
    it("should confirm matching passwords", () => {
      const password = "TestPassword123!";
      const confirmation = "TestPassword123!";

      expect(passwordsMatch(password, confirmation)).toBe(true);
    });

    it("should reject non-matching passwords", () => {
      const password = "TestPassword123!";
      const confirmation = "DifferentPassword123!";

      expect(passwordsMatch(password, confirmation)).toBe(false);
    });

    it("should reject empty passwords", () => {
      expect(passwordsMatch("", "")).toBe(false);
    });

    it("should be case-sensitive", () => {
      const password = "TestPassword123!";
      const confirmation = "testpassword123!";

      expect(passwordsMatch(password, confirmation)).toBe(false);
    });

    it("should detect single character differences", () => {
      const password = "TestPassword123!";
      const confirmation = "TestPassword124!";

      expect(passwordsMatch(password, confirmation)).toBe(false);
    });
  });

  describe("Password Attack Scenarios", () => {
    it("should resist brute force attacks with bcrypt slowness", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      // Measure time for multiple checks (simulating brute force)
      const start = performance.now();
      const attempts = 10;

      for (let i = 0; i < attempts; i++) {
        await checkPassword(`attempt${i}`, hash);
      }

      const duration = performance.now() - start;
      const avgPerAttempt = duration / attempts;

      // Each attempt should take significant time (bcrypt is slow)
      // This makes brute force impractical
      expect(avgPerAttempt).toBeGreaterThan(5); // At least 5ms per attempt
    });

    it("should prevent rainbow table attacks with unique salts", async () => {
      const password = "CommonPassword123!";

      // Generate multiple hashes for same password
      const hashes = await Promise.all(
        Array.from({ length: 10 }, () => hashPassword(password))
      );

      // All hashes should be unique (different salts)
      const uniqueHashes = new Set(hashes);
      expect(uniqueHashes.size).toBe(10);
    });

    it("should prevent password spraying with validation", () => {
      // Common passwords that should be rejected
      const commonPasswords = [
        "Password123!",
        "Welcome123!",
        "Admin123!@#",
        "Letmein123!"
      ];

      for (const password of commonPasswords) {
        const result = validatePassword(password);
        expect(result.isValid).toBe(false);
      }
    });

    it("should resist dictionary attacks", () => {
      // Dictionary words that should be caught
      const dictionaryBased = ["Sunshine123!", "Princess456!", "Dragon789!@"];

      for (const password of dictionaryBased) {
        const result = validatePassword(password);
        expect(result.isValid).toBe(false);
      }
    });
  });

  describe("Edge Cases", () => {
    it("should handle very long passwords", async () => {
      const longPassword = "A1!a" + "x".repeat(1000); // Very long but valid
      const hash = await hashPassword(longPassword);
      const match = await checkPassword(longPassword, hash);

      expect(match).toBe(true);
    });

    it("should handle passwords with only whitespace", async () => {
      const whitespacePassword = "    ";
      const result = validatePassword(whitespacePassword);

      expect(result.isValid).toBe(false);
    });

    it("should handle null bytes in passwords", async () => {
      const nullBytePassword = "Test\0Password123!";
      const hash = await hashPassword(nullBytePassword);
      const match = await checkPassword(nullBytePassword, hash);

      // Behavior may vary - just ensure no crash
      expect(typeof match).toBe("boolean");
    });

    it("should handle passwords with emoji", () => {
      const emojiPassword = "MyP@ssw0rd🔐🛡️123";
      const result = validatePassword(emojiPassword);

      expect(result.isValid).toBe(true);
    });

    it("should handle passwords with newlines", async () => {
      const newlinePassword = "Test\nPassword123!";
      const hash = await hashPassword(newlinePassword);
      const match = await checkPassword(newlinePassword, hash);

      expect(match).toBe(true);
    });

    it("should handle passwords with tabs", async () => {
      const tabPassword = "Test\tPassword123!";
      const hash = await hashPassword(tabPassword);
      const match = await checkPassword(tabPassword, hash);

      expect(match).toBe(true);
    });
  });

  describe("Performance", () => {
    it("should hash passwords with appropriate slowness", async () => {
      const password = "TestPassword123!";

      const start = performance.now();
      await hashPassword(password);
      const duration = performance.now() - start;

      // Bcrypt should be slow enough to deter brute force
      // With 10 rounds, should take at least a few milliseconds
      expect(duration).toBeGreaterThan(5);
      // But not too slow for normal operation
      expect(duration).toBeLessThan(500);
    });

    it("should verify passwords with consistent timing", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      const durations: number[] = [];
      for (let i = 0; i < 5; i++) {
        const start = performance.now();
        await checkPassword(password, hash);
        durations.push(performance.now() - start);
      }

      // Timing should be relatively consistent
      const avg = durations.reduce((a, b) => a + b, 0) / durations.length;
      const maxDeviation = Math.max(...durations.map((d) => Math.abs(d - avg)));

      // Allow reasonable variance
      expect(maxDeviation).toBeLessThan(avg * 0.5);
    });

    it("should validate passwords quickly", () => {
      const password = "TestPassword123!";

      const start = performance.now();
      for (let i = 0; i < 10000; i++) {
        validatePassword(password);
      }
      const duration = performance.now() - start;

      // Validation is CPU-bound but should be fast
      expect(duration).toBeLessThan(100);
    });
  });

  describe("bcrypt Salt Rounds", () => {
    it("should use appropriate salt rounds for security", async () => {
      const password = "TestPassword123!";
      const hash = await hashPassword(password);

      // Check that hash uses correct salt rounds
      // Bcrypt format: $2b$rounds$salthash
      const parts = hash.split("$");
      const rounds = parseInt(parts[2]);

      // Should use 10 rounds (from password.ts)
      expect(rounds).toBe(10);
    });

    it("should generate cryptographically random salts", async () => {
      const password = "TestPassword123!";
      const hashes = await Promise.all(
        Array.from({ length: 100 }, () => hashPassword(password))
      );

      // Extract salts from hashes
      const salts = hashes.map((hash) => {
        const parts = hash.split("$");
        return parts[3].substring(0, 22); // Salt is 22 characters
      });

      // All salts should be unique
      const uniqueSalts = new Set(salts);
      expect(uniqueSalts.size).toBe(100);

      // Check for patterns in salts (should be random)
      for (let i = 1; i < salts.length; i++) {
        // Salts should not be sequential or predictable
        expect(salts[i]).not.toBe(salts[i - 1]);
      }
    });
  });
});