package scryptx_test

import (
	"bytes"
	"encoding/hex"
	"math"
	"testing"

	"code.yun.ink/pkg/encryptx/scryptx"
)

// 测试统一使用远小于默认值的内存参数，避免测试机耗时过长。
const (
	testN = 1 << 10 // 1 MiB 工作内存
	testR = 8
	testP = 1
)

// TestDeriveKeyKnownVectors 使用 RFC 7914 第 12 节的官方 scrypt 向量，
// 以及 Python 3.13 hashlib.scrypt 独立生成的小参数向量。
func TestDeriveKeyKnownVectors(t *testing.T) {
	cases := []struct {
		name      string
		password  []byte
		salt      []byte
		n, r, p   int
		keyLength int
		want      string
	}{
		{
			// RFC 7914 §12: scrypt(P="pleaseletmein", S="SodiumChloride",
			// N=16384, r=8, p=1, dkLen=64)
			name:      "RFC7914-N16384-r8-p1",
			password:  []byte("pleaseletmein"),
			salt:      []byte("SodiumChloride"),
			n:         16384,
			r:         8,
			p:         1,
			keyLength: 64,
			want:      "7023bdcb3afd7348461c06cd81fd38ebfda8fbba904f8e3ea9b543f6545da1f2d5432955613f0fcf62d49705242a9af9e61e85dc0d651e40dfcf017b45575887",
		},
		{
			// hashlib.scrypt(b'password', salt=b'saltsaltsalt', n=1024, r=8, p=1, dklen=32)
			name:      "python-n1024-r8-p1",
			password:  []byte("password"),
			salt:      []byte("saltsaltsalt"),
			n:         1024,
			r:         8,
			p:         1,
			keyLength: 32,
			want:      "3d33aa071ee47b3d50096e7e58fe5cf9918eba38c6a7218e961d0badce7a4deb",
		},
		{
			// hashlib.scrypt(b'password', salt=b'saltsaltsalt', n=16384, r=8, p=1, dklen=32)
			name:      "python-n16384-r8-p1",
			password:  []byte("password"),
			salt:      []byte("saltsaltsalt"),
			n:         16384,
			r:         8,
			p:         1,
			keyLength: 32,
			want:      "316fe485a31e8d960549f59c5f9e0a33dec4cc15bd1bf55fe22b1fa484da2c1d",
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got, err := scryptx.DeriveKey(tc.password, tc.salt, tc.n, tc.r, tc.p, tc.keyLength)
			if err != nil {
				t.Fatalf("派生失败: %v", err)
			}
			if hex.EncodeToString(got) != tc.want {
				t.Errorf("与已知向量不一致\n got: %s\nwant: %s", hex.EncodeToString(got), tc.want)
			}
		})
	}
}

func TestDeriveKeyReproducible(t *testing.T) {
	password := []byte("正确的马电池订书钉")
	salt := []byte("0123456789abcdef")

	k1, err := scryptx.DeriveKey(password, salt, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("派生失败: %v", err)
	}
	k2, err := scryptx.DeriveKey(password, salt, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("派生失败: %v", err)
	}
	if !bytes.Equal(k1, k2) {
		t.Fatal("相同输入两次派生结果不一致")
	}

	other, err := scryptx.DeriveKey(password, []byte("fedcba9876543210"), testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("换盐派生失败: %v", err)
	}
	if bytes.Equal(k1, other) {
		t.Error("不同盐得到了相同密钥")
	}

	otherN, err := scryptx.DeriveKey(password, salt, testN*2, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("换 n 派生失败: %v", err)
	}
	if bytes.Equal(k1, otherN) {
		t.Error("不同 n 得到了相同密钥")
	}

	otherP, err := scryptx.DeriveKey(password, salt, testN, testR, testP+1, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("换 p 派生失败: %v", err)
	}
	if bytes.Equal(k1, otherP) {
		t.Error("不同 p 得到了相同密钥")
	}
}

// TestDeriveKeyWithRandomSalt 断言返回的盐确实能复现同一个密钥。
func TestDeriveKeyWithRandomSalt(t *testing.T) {
	password := []byte("hunter2")

	key, salt, err := scryptx.DeriveKeyWithRandomSalt(password, scryptx.DefaultSaltLength, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("DeriveKeyWithRandomSalt 返回错误: %v", err)
	}
	if len(salt) != scryptx.DefaultSaltLength {
		t.Fatalf("返回的盐长度 = %d, 期望 %d", len(salt), scryptx.DefaultSaltLength)
	}
	if len(key) != scryptx.DefaultKeyLength {
		t.Fatalf("返回的密钥长度 = %d, 期望 %d", len(key), scryptx.DefaultKeyLength)
	}

	reproduced, err := scryptx.DeriveKey(password, salt, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("用返回的盐复现失败: %v", err)
	}
	if !bytes.Equal(key, reproduced) {
		t.Fatal("用 DeriveKeyWithRandomSalt 返回的盐无法复现同一密钥")
	}

	key2, salt2, err := scryptx.DeriveKeyWithRandomSalt(password, scryptx.DefaultSaltLength, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("第二次 DeriveKeyWithRandomSalt 失败: %v", err)
	}
	if bytes.Equal(salt, salt2) {
		t.Error("两次调用返回了相同的盐")
	}
	if bytes.Equal(key, key2) {
		t.Error("两次调用返回了相同的密钥")
	}

	for _, bad := range []int{0, -1, scryptx.MinSaltLength - 1, 1025, math.MaxInt} {
		if _, _, err := scryptx.DeriveKeyWithRandomSalt(password, bad, testN, testR, testP, scryptx.DefaultKeyLength); err == nil {
			t.Errorf("saltLength=%d 时未返回错误", bad)
		}
	}
}

func TestVerify(t *testing.T) {
	password := []byte("s3cret-口令")
	salt := []byte("0123456789abcdef")
	key, err := scryptx.DeriveKey(password, salt, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("派生失败: %v", err)
	}

	ok, err := scryptx.Verify(password, salt, key, testN, testR, testP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("Verify 返回错误: %v", err)
	}
	if !ok {
		t.Error("正确口令未通过校验")
	}

	cases := []struct {
		name     string
		password []byte
		salt     []byte
		expected []byte
	}{
		{"错误口令", []byte("s3cret-口令x"), salt, key},
		{"错误盐", password, []byte("fedcba9876543210"), key},
		{"密钥被篡改", password, salt, append(append([]byte{}, key[:len(key)-1]...), key[len(key)-1]^0x01)},
		{"密钥被截断", password, salt, key[:len(key)-1]},
		{"密钥被加长", password, salt, append(append([]byte{}, key...), 0x00)},
		{"空密钥", password, salt, nil},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			ok, err := scryptx.Verify(tc.password, tc.salt, tc.expected, testN, testR, testP, scryptx.DefaultKeyLength)
			if err != nil {
				t.Fatalf("参数合法时 Verify 不应返回错误: %v", err)
			}
			if ok {
				t.Error("不匹配的密钥被判为匹配")
			}
		})
	}
}

// TestParameterValidation 覆盖非法参数：必须返回 error 且不 panic。
func TestParameterValidation(t *testing.T) {
	validSalt := bytes.Repeat([]byte{0xA5}, scryptx.MinSaltLength)
	password := []byte("pw")

	cases := []struct {
		name        string
		salt        []byte
		n, r, p     int
		keyLength   int
		saltInvalid bool
	}{
		{"盐为 nil", nil, testN, testR, testP, 32, true},
		{"盐为空切片", []byte{}, testN, testR, testP, 32, true},
		{"盐过短", []byte("1234567"), testN, testR, testP, 32, true},
		{"盐过长", bytes.Repeat([]byte{0x01}, 1025), testN, testR, testP, 32, true},
		{"n 为 0", validSalt, 0, testR, testP, 32, false},
		{"n 为 1", validSalt, 1, testR, testP, 32, false},
		{"n 为负", validSalt, -1024, testR, testP, 32, false},
		{"n 为 3（非 2 的幂）", validSalt, 3, testR, testP, 32, false},
		{"n 为 1000（非 2 的幂）", validSalt, 1000, testR, testP, 32, false},
		{"n 超上限", validSalt, scryptx.MaxN * 2, testR, testP, 32, false},
		{"n 为 MaxInt", validSalt, math.MaxInt, testR, testP, 32, false},
		{"r 为 0", validSalt, testN, 0, testP, 32, false},
		{"r 为负", validSalt, testN, -8, testP, 32, false},
		{"p 为 0", validSalt, testN, testR, 0, 32, false},
		{"p 为负", validSalt, testN, testR, -1, 32, false},
		{"密钥长度为 0", validSalt, testN, testR, testP, 0, false},
		{"密钥长度为负", validSalt, testN, testR, testP, -32, false},
		{"密钥长度超上限", validSalt, testN, testR, testP, scryptx.MaxKeyLength + 1, false},
		{"内存代价超上限", validSalt, 1 << 20, 64, 1, 32, false},
		{"p 极大导致内存超上限", validSalt, 2, 1, 1 << 29, 32, false},
		{"参数溢出", validSalt, 1 << 20, math.MaxInt, 1, 32, false},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			key, err := scryptx.DeriveKey(password, tc.salt, tc.n, tc.r, tc.p, tc.keyLength)
			if err == nil {
				t.Fatalf("未返回错误，得到 %d 字节密钥", len(key))
			}
			if key != nil {
				t.Errorf("出错时密钥应为 nil，实际长度 %d", len(key))
			}
			if _, err := scryptx.Verify(password, tc.salt, validSalt, tc.n, tc.r, tc.p, tc.keyLength); err == nil {
				t.Error("Verify 对非法参数未返回错误")
			}
			// DeriveKeyWithRandomSalt 自行生成盐，因此仅在 n/r/p/长度非法时才应报错。
			if !tc.saltInvalid {
				if _, _, err := scryptx.DeriveKeyWithRandomSalt(password, scryptx.DefaultSaltLength, tc.n, tc.r, tc.p, tc.keyLength); err == nil {
					t.Error("DeriveKeyWithRandomSalt 对非法参数未返回错误")
				}
			}
		})
	}
}

// TestBoundaryValues 验证边界参数落在允许一侧时可用，且默认参数可正常完成。
func TestBoundaryValues(t *testing.T) {
	salt := bytes.Repeat([]byte{0x5A}, scryptx.MinSaltLength)

	// n=2 是最小的合法值（1<<1），r=p=1。
	key, err := scryptx.DeriveKey([]byte("pw"), salt, 2, 1, 1, 1)
	if err != nil {
		t.Fatalf("最小合法参数派生失败: %v", err)
	}
	if len(key) != 1 {
		t.Errorf("密钥长度 = %d, 期望 1", len(key))
	}

	// 较大的 n 在内存上限内应被接受：n=1<<18、r=1 约 32 MiB，耗时可接受。
	key, err = scryptx.DeriveKey([]byte("pw"), salt, 1<<18, 1, 1, scryptx.MaxKeyLength)
	if err != nil {
		t.Fatalf("n=1<<18、r=1 应被接受: %v", err)
	}
	if len(key) != scryptx.MaxKeyLength {
		t.Errorf("密钥长度 = %d, 期望 %d", len(key), scryptx.MaxKeyLength)
	}

	// 默认参数必须可用（32 MiB，约 0.1s）。
	key, err = scryptx.DeriveKey([]byte("pw"), salt, scryptx.DefaultN, scryptx.DefaultR, scryptx.DefaultP, scryptx.DefaultKeyLength)
	if err != nil {
		t.Fatalf("默认参数派生失败: %v", err)
	}
	if len(key) != scryptx.DefaultKeyLength {
		t.Errorf("默认参数派生长度 = %d, 期望 %d", len(key), scryptx.DefaultKeyLength)
	}
}

func TestGenerateSalt(t *testing.T) {
	for _, length := range []int{scryptx.MinSaltLength, scryptx.DefaultSaltLength, 32} {
		salt, err := scryptx.GenerateSalt(length)
		if err != nil {
			t.Fatalf("GenerateSalt(%d) 返回错误: %v", length, err)
		}
		if len(salt) != length {
			t.Errorf("盐长度 = %d, 期望 %d", len(salt), length)
		}
	}

	a, err := scryptx.GenerateSalt(scryptx.DefaultSaltLength)
	if err != nil {
		t.Fatalf("GenerateSalt 返回错误: %v", err)
	}
	b, err := scryptx.GenerateSalt(scryptx.DefaultSaltLength)
	if err != nil {
		t.Fatalf("GenerateSalt 返回错误: %v", err)
	}
	if bytes.Equal(a, b) {
		t.Error("两次生成的盐相同")
	}

	for _, length := range []int{0, -1, scryptx.MinSaltLength - 1, 1025, math.MaxInt} {
		if _, err := scryptx.GenerateSalt(length); err == nil {
			t.Errorf("GenerateSalt(%d) 未返回错误", length)
		}
	}
}