import { describe, expect, test } from 'bun:test';
import { deriveVaultPassword } from './vault';

describe('Vault Password Derivation', () => {
  test('should derive consistent password from master key', () => {
    const masterKey = Buffer.alloc(32, 0xaa);
    const password1 = deriveVaultPassword(masterKey);
    const password2 = deriveVaultPassword(masterKey);

    expect(password1).toBe(password2);
    expect(password1).toHaveLength(64); // SHA-256 hex = 64 chars
  });

  test('should derive different passwords for different keys', () => {
    const key1 = Buffer.alloc(32, 0xaa);
    const key2 = Buffer.alloc(32, 0xbb);

    const password1 = deriveVaultPassword(key1);
    const password2 = deriveVaultPassword(key2);

    expect(password1).not.toBe(password2);
  });

  test('should reject invalid master key', () => {
    const tooShort = Buffer.alloc(16);
    expect(() => deriveVaultPassword(tooShort)).toThrow('Master key must be 32 bytes');
  });

  test('should produce valid hex string', () => {
    const masterKey = Buffer.alloc(32, 0xaa);
    const password = deriveVaultPassword(masterKey);

    expect(password).toMatch(/^[0-9a-f]{64}$/);
  });
});