package seal_test

import (
	"bytes"
	"testing"

	"sneak.berlin/go/pixa/internal/seal"
)

// TestDeriveKeys_KeysDiffer verifies that the keys DeriveKeys derives differ
// from each other and from the signing key.
func TestDeriveKeys_KeysDiffer(t *testing.T) {
	t.Parallel()

	// 32 bytes, as long as a derived key, so that no key differs from it by
	// its length alone
	const signingKey = "0123456789abcdef0123456789abcdef"

	keys, err := seal.DeriveKeys(signingKey)
	if err != nil {
		t.Fatalf("DeriveKeys() error = %v", err)
	}

	named := []struct {
		name string
		key  []byte
	}{
		{"the signing key", []byte(signingKey)},
		{"SessionHashKey", keys.SessionHashKey[:]},
		{"SessionBlockKey", keys.SessionBlockKey[:]},
		{"EncryptedURLKey", keys.EncryptedURLKey[:]},
		{"CSRFKey", keys.CSRFKey[:]},
	}

	for i, a := range named {
		for _, b := range named[i+1:] {
			if bytes.Equal(a.key, b.key) {
				t.Errorf("%s equals %s", a.name, b.name)
			}
		}
	}
}