import logging

import pytest


def test_password_policy_rejects_weak_passwords():
    from app.commands.bootstrap_admin import validate_password

    for password in ("short", "alllowercase1", "ALLUPPERCASE1", "NoDigitsHere"):
        with pytest.raises(ValueError):
            validate_password(password)

    validate_password("AdminPass123")


def test_bootstrap_logs_never_contain_password(caplog):
    from app.commands.bootstrap_admin import log_bootstrap_result

    password = "AdminPass123"
    with caplog.at_level(logging.INFO):
        log_bootstrap_result("admin", created=True)

    assert "admin" in caplog.text
    assert password not in caplog.text


def test_password_is_argon2id_and_verifiable():
    from app.core.system.auth import hash_password, verify_password

    encoded = hash_password("AdminPass123")

    assert encoded.startswith("$argon2id$")
    assert verify_password(encoded, "AdminPass123") is True
    assert verify_password(encoded, "wrong-password") is False