package secretbox

import (
	"strings"
	"testing"
)

func TestSealOpenRoundTripAndKeys(t *testing.T) {
	key := GenerateKey()
	b, err := New(key)
	if err != nil {
		t.Fatal(err)
	}
	sealed := b.Seal("hunter2")
	if !strings.HasPrefix(sealed, "enc1:") || strings.Contains(sealed, "hunter2") {
		t.Fatalf("not sealed: %q", sealed)
	}
	if again := b.Seal("hunter2"); again == sealed {
		t.Error("two seals of the same value must differ (random nonce)")
	}
	if b.Seal(sealed) != sealed {
		t.Error("sealing an already sealed value must not double-encrypt")
	}
	if got, err := b.Open(sealed); err != nil || got != "hunter2" {
		t.Errorf("Open = %q, %v", got, err)
	}
	if got, _ := b.Open("legacy plaintext"); got != "legacy plaintext" {
		t.Errorf("unsealed legacy data should pass through, got %q", got)
	}
	if b.Seal("") != "" {
		t.Error("empty stays empty")
	}

	other, _ := New(GenerateKey())
	if _, err := other.Open(sealed); err == nil {
		t.Error("the wrong key must fail loudly, not return garbage")
	}
	if _, err := b.Open(sealed[:len(sealed)-4] + "AAAA"); err == nil {
		t.Error("tampered data must fail")
	}

	// a passphrase works as a key, and is stable
	p1, _ := New("correct horse battery staple")
	p2, _ := New("correct horse battery staple")
	if got, err := p2.Open(p1.Seal("x")); err != nil || got != "x" {
		t.Errorf("passphrase keys must be reproducible: %q %v", got, err)
	}
	if _, err := New("  "); err == nil {
		t.Error("an empty key must be rejected")
	}
}