package sshutil

import "testing"

func TestSecureConfigUsesSupportedAlgorithms(t *testing.T) {
	cfg := SecureConfig()
	if len(cfg.KeyExchanges) == 0 {
		t.Fatalf("expected key exchanges")
	}
	if len(cfg.Ciphers) == 0 {
		t.Fatalf("expected ciphers")
	}
	if len(cfg.MACs) == 0 {
		t.Fatalf("expected MACs")
	}
}

func TestHostKeyCallbackStrictRequiresKnownHosts(t *testing.T) {
	if _, _, err := HostKeyCallback("", true, "test"); err == nil {
		t.Fatalf("expected strict host key mode without known_hosts to fail")
	}
}

func TestHostKeyCallbackAllowsCompatibilityFallback(t *testing.T) {
	cb, mode, err := HostKeyCallback("", false, "test")
	if err != nil {
		t.Fatalf("HostKeyCallback: %v", err)
	}
	if cb == nil {
		t.Fatalf("expected callback")
	}
	if mode != "insecure-unverified-host-key" {
		t.Fatalf("mode = %q, want insecure-unverified-host-key", mode)
	}
}