tests/test_password.py

from backend.auth.password import hash_password, verify_password


def test_hash_returns_string():
    result = hash_password("secret123")
    assert isinstance(result, str)
    assert result != "secret123"


def test_verify_correct_password():
    hashed = hash_password("mypassword")
    assert verify_password("mypassword", hashed) is True


def test_verify_wrong_password():
    hashed = hash_password("mypassword")
    assert verify_password("wrongpassword", hashed) is False


def test_same_password_different_hashes():
    h1 = hash_password("same")
    h2 = hash_password("same")
    assert h1 != h2  # bcrypt uses random salt