package seal

import (
	"bytes"
	"encoding/base64"
	"testing"
)

func TestRoundTripAndBinding(t *testing.T) {
	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{7}, keySize))
	box, err := New(key)
	if err != nil {
		t.Fatal(err)
	}
	sealed := box.Seal("secret-value", "42/usos_token")
	if bytes.Contains(sealed, []byte("secret-value")) {
		t.Fatal("plaintext is visible in the sealed value")
	}
	if got, err := box.Open(sealed, "42/usos_token"); err != nil || got != "secret-value" {
		t.Fatalf("Open = %q, %v", got, err)
	}
	if _, err := box.Open(sealed, "43/usos_token"); err == nil {
		t.Fatal("a value sealed for one user opened for another")
	}
	if bytes.Equal(sealed, box.Seal("secret-value", "42/usos_token")) {
		t.Fatal("sealing twice produced the same bytes")
	}
}

func TestRejectsWeakKeys(t *testing.T) {
	for _, key := range []string{"", "CHANGEME", base64.StdEncoding.EncodeToString([]byte("short"))} {
		if _, err := New(key); err == nil {
			t.Errorf("New(%q) accepted a bad key", key)
		}
	}
}