# tests/api/test_auth.py
import pytest

def test_create_and_verify_token():
    from sanguo_api.auth import create_token, verify_token, set_jwt_config
    set_jwt_config(secret="test_secret", expire_minutes=60)
    token = create_token("admin")
    assert isinstance(token, str)
    assert verify_token(token) == "admin"

def test_verify_token_invalid_raises_401():
    from fastapi import HTTPException
    from sanguo_api.auth import verify_token, set_jwt_config
    set_jwt_config(secret="test_secret", expire_minutes=60)
    with pytest.raises(HTTPException) as exc:
        verify_token("invalid.token.here")
    assert exc.value.status_code == 401

def test_hash_and_verify_password():
    from sanguo_api.auth import hash_password, verify_password
    h = hash_password("mypass")
    assert h != "mypass"
    assert verify_password("mypass", h) is True
    assert verify_password("wrong", h) is False