Add some tests

Author: ptoffy

Sources/Bcrypt/EksBlowfish.swift

@@ -11,7 +11,9 @@
     static func setup(password: [UInt8], salt: [UInt8], cost: Int) -> (p: [UInt32], s: [UInt32]) {
         assert(cost >= 4 && cost <= 31, "Cost must be between 4 and 31, is \(cost)")
         assert(salt.count == 16, "Salt must be 16 bytes long, is \(salt.count)")
-        assert(password.count > 0 && password.count <= 72, "Password must be between 1 and 72 bytes long, is \(password.count)")
+        assert(
+            password.count > 0 && password.count <= 73,
+            "Password must be between 1 and 73 bytes long counting the NULL terminator, is \(password.count)")
 
         var (p, s) = (Self.initialP, Self.initialS)
 

Sources/Bcrypt/Hasher.swift

@@ -13,7 +13,7 @@ extension Bcrypt {
     /// - Throws: ``BcryptError``
     /// - Returns: the hashed password.
     @inlinable
-    public static func hash(password: String, cost: Int = 10, version: BcryptVersion = .v2b) throws -> String {
+    public static func hash(password: String, cost: Int = 10, version: BcryptVersion = .v2b) throws(BcryptError) -> String {
         String(
             decoding: try hash(password: Array(password.utf8), cost: cost, salt: Self.generateRandomSalt(), version: version),
             as: UTF8.self
@@ -28,7 +28,7 @@ extension Bcrypt {
     /// - Throws: ``BcryptError``
     /// - Returns: the hashed password.
     @inlinable
-    public static func hash(password: [UInt8], cost: Int = 10, version: BcryptVersion = .v2b) throws -> [UInt8] {
+    public static func hash(password: [UInt8], cost: Int = 10, version: BcryptVersion = .v2b) throws(BcryptError) -> [UInt8] {
         try hash(password: password, cost: cost, salt: Self.generateRandomSalt(), version: version)
     }
 
@@ -41,7 +41,8 @@ extension Bcrypt {
     /// - Throws: ``BcryptError``
     /// - Returns: the hashed password.
     @inlinable
-    public static func hash(password: [UInt8], cost: Int = 10, salt: [UInt8], version: BcryptVersion = .v2b) throws -> [UInt8] {
+    public static func hash(password: [UInt8], cost: Int = 10, salt: [UInt8], version: BcryptVersion = .v2b) throws(BcryptError) -> [UInt8]
+    {
         guard (salt.count * 3 / 4) - 1 < Self.maxSalt else {
             throw BcryptError.invalidSaltLength
         }
@@ -62,7 +63,7 @@ extension Bcrypt {
         switch version {
         case .v2a: break
         case .v2b:
-            guard password.count <= 72 else {
+            guard password.count <= 73 else {  // 72 + 1 because of the NULL terminator
                 throw BcryptError.passwordTooLong
             }
         }

Sources/Bcrypt/Verifier.swift

@@ -6,7 +6,7 @@ extension Bcrypt {
     /// - Throws: ``BcryptError``
     /// - Returns: `true` if the password matches the hash, `false` otherwise.
     @inlinable
-    public static func verify(password: String, hash: String) throws -> Bool {
+    public static func verify(password: String, hash: String) throws(BcryptError) -> Bool {
         try verify(password: Array(password.utf8), hash: Array(hash.utf8))
     }
 
@@ -17,7 +17,7 @@ extension Bcrypt {
     /// - Throws: ``BcryptError``
     /// - Returns: `true` if the password matches the hash, `false` otherwise.
     @inlinable
-    public static func verify(password: [UInt8], hash goodHash: [UInt8]) throws -> Bool {
+    public static func verify(password: [UInt8], hash goodHash: [UInt8]) throws(BcryptError) -> Bool {
         let prefix = goodHash.prefix(7)
 
         let version = BcryptVersion(identifier: Array(prefix[1...2]))

Tests/BcryptTests/BcryptTests.swift

@@ -31,4 +31,64 @@ struct BcryptTests {
 
         #expect(hash.hasPrefix("$2b$06$"))
     }
+
+    @Test("Empty password")
+    func emptyPassword() throws {
+        #expect(throws: Error.self) {
+            try Bcrypt.hash(password: "", cost: 6)
+        }
+    }
+
+    @Test("Maximum length password (72 bytes)")
+    func maximumLengthPassword() throws {
+        let password = String(repeating: "a", count: 72)
+        let hash = try Bcrypt.hash(password: password, cost: 6)
+        #expect(try Bcrypt.verify(password: password, hash: hash))
+    }
+
+    @Test("Password too long")
+    func passwordTooLong() throws {
+        let password = String(repeating: "a", count: 73)
+        #expect(throws: BcryptError.passwordTooLong) {
+            try Bcrypt.hash(password: password, cost: 6)
+        }
+    }
+
+    @Test("Different passwords produce different hashes")
+    func differentPasswordsDifferentHashes() throws {
+        let hash1 = try Bcrypt.hash(password: "password1", cost: 6)
+        let hash2 = try Bcrypt.hash(password: "password2", cost: 6)
+
+        #expect(hash1 != hash2)
+    }
+
+    @Test("Same password with different salts produces different hashes")
+    func samePwDifferentSalts() throws {
+        let password = "test"
+        let hash1 = try Bcrypt.hash(password: password, cost: 6)
+        let hash2 = try Bcrypt.hash(password: password, cost: 6)
+
+        // Different salts should produce different hashes
+        #expect(hash1 != hash2)
+
+        // But both should verify
+        #expect(try Bcrypt.verify(password: password, hash: hash1))
+        #expect(try Bcrypt.verify(password: password, hash: hash2))
+    }
+
+    @Test("Unicode password handling")
+    func unicodePassword() throws {
+        let passwords = ["πάσσω", "密码", "🔐🔑", "Ñoño"]
+
+        for password in passwords {
+            let hash = try Bcrypt.hash(password: password, cost: 4)
+            #expect(try Bcrypt.verify(password: password, hash: hash))
+        }
+    }
+
+    @Test("Wrong password fails verification")
+    func wrongPasswordFails() throws {
+        let hash = try Bcrypt.hash(password: "correct", cost: 6)
+        #expect(try !Bcrypt.verify(password: "wrong", hash: hash))
+    }
 }