package agentd

import "testing"

func TestDeriveHy2Password(t *testing.T) {
	const dp = "11111111-1111-1111-1111-111111111111"

	// Deterministic for a given (dp, key).
	a := DeriveHy2Password(dp, "secret")
	b := DeriveHy2Password(dp, "secret")
	if a != b {
		t.Fatalf("derivation not deterministic: %q != %q", a, b)
	}
	// Different key → different password.
	if DeriveHy2Password(dp, "other") == a {
		t.Fatal("different key produced identical password")
	}
	// Different dp_uuid → different password.
	if DeriveHy2Password("22222222-2222-2222-2222-222222222222", "secret") == a {
		t.Fatal("different dp_uuid produced identical password")
	}
	// The derived value is not the raw dp_uuid (must look like an opaque secret).
	if a == dp {
		t.Fatal("derived password equals raw dp_uuid")
	}
	// Empty key → raw dp_uuid fallback (dev mode).
	if got := DeriveHy2Password(dp, ""); got != dp {
		t.Fatalf("empty key fallback = %q, want raw dp_uuid", got)
	}
}