from cryptography.fernet import Fernet

from app.security.credentials import CredentialCipher


def test_round_trip_and_ciphertext_does_not_contain_plaintext() -> None:
    cipher = CredentialCipher(Fernet.generate_key().decode("ascii"))
    encrypted = cipher.encrypt("secret-password")

    assert "secret-password" not in encrypted
    assert cipher.decrypt(encrypted) == "secret-password"


def test_empty_credentials_are_rejected() -> None:
    cipher = CredentialCipher(Fernet.generate_key().decode("ascii"))
    try:
        cipher.encrypt("")
    except ValueError:
        return
    raise AssertionError("empty secrets must be rejected")