package credential

import (
	"crypto/rand"
	"testing"
)

func TestVaultSeparatesDeviceAndPurpose(t *testing.T) {
	key := make([]byte, 32)
	if _, err := rand.Read(key); err != nil {
		t.Fatal(err)
	}
	vault, err := NewVault(key)
	if err != nil {
		t.Fatal(err)
	}
	ciphertext, err := vault.Encrypt("device-a", PurposeONVIF, "synthetic-user", "synthetic-password")
	if err != nil {
		t.Fatal(err)
	}
	username, password, err := vault.Decrypt("device-a", PurposeONVIF, ciphertext)
	if err != nil || username != "synthetic-user" || password != "synthetic-password" {
		t.Fatalf("credential round trip failed: username=%q err=%v", username, err)
	}
	if _, _, err = vault.Decrypt("device-a", PurposeRTSP, ciphertext); err == nil {
		t.Fatal("credential ciphertext was reusable for another purpose")
	}
	if _, _, err = vault.Decrypt("device-b", PurposeONVIF, ciphertext); err == nil {
		t.Fatal("credential ciphertext was reusable for another device")
	}
}

func TestVaultRejectsInvalidKeyLength(t *testing.T) {
	if _, err := NewVault(make([]byte, 16)); err == nil {
		t.Fatal("short credential key accepted")
	}
}