Assignment 4: tests, interface refactor, e2e suite

internal/auth/password_test.go

@@ -0,0 +1,97 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestHashPassword(t *testing.T) {
+	const plain = "secret123"
+
+	t.Run("hash never equals plaintext", func(t *testing.T) {
+		hash, err := HashPassword(plain)
+		if err != nil {
+			t.Fatalf("HashPassword returned error: %v", err)
+		}
+		if hash == "" {
+			t.Fatal("hash must not be empty")
+		}
+		if hash == plain {
+			t.Fatal("hash must not equal the plaintext password")
+		}
+		if strings.Contains(hash, plain) {
+			t.Fatal("hash must not contain the plaintext password")
+		}
+	})
+
+	t.Run("same password hashed twice gives different hashes", func(t *testing.T) {
+		h1, err := HashPassword(plain)
+		if err != nil {
+			t.Fatalf("first HashPassword returned error: %v", err)
+		}
+		h2, err := HashPassword(plain)
+		if err != nil {
+			t.Fatalf("second HashPassword returned error: %v", err)
+		}
+		if h1 == h2 {
+			t.Fatal("two hashes of the same password must differ (salting)")
+		}
+	})
+
+	t.Run("hash verifies against original password", func(t *testing.T) {
+		hash, err := HashPassword(plain)
+		if err != nil {
+			t.Fatalf("HashPassword returned error: %v", err)
+		}
+		if !CheckPassword(plain, hash) {
+			t.Fatal("CheckPassword must accept the original password")
+		}
+	})
+
+	t.Run("password longer than 72 bytes returns an error", func(t *testing.T) {
+		hash, err := HashPassword(strings.Repeat("a", 73))
+		if err == nil {
+			t.Fatal("expected an error for a password longer than 72 bytes")
+		}
+		if hash != "" {
+			t.Fatalf("expected empty hash on error, got %q", hash)
+		}
+	})
+}
+
+func TestCheckPassword(t *testing.T) {
+	const plain = "secret123"
+
+	hash, err := HashPassword(plain)
+	if err != nil {
+		t.Fatalf("HashPassword returned error: %v", err)
+	}
+
+	tests := []struct {
+		name     string
+		password string
+		hash     string
+		want     bool
+	}{
+		{name: "correct password", password: plain, hash: hash, want: true},
+		{name: "wrong password", password: "wrong-password", hash: hash, want: false},
+		{name: "empty password", password: "", hash: hash, want: false},
+		{name: "garbage hash string", password: plain, hash: "this-is-not-a-bcrypt-hash", want: false},
+		{name: "empty hash string", password: plain, hash: "", want: false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("CheckPassword panicked: %v", r)
+				}
+			}()
+
+			got := CheckPassword(tc.password, tc.hash)
+			if got != tc.want {
+				t.Fatalf("CheckPassword(%q, hash) = %v, want %v", tc.password, got, tc.want)
+			}
+		})
+	}
+}