from openvpncertupdate import generate_password

BANNED_ALL       = set("oO01lIQ5S2Z8B")
BANNED_POS2_LAST = BANNED_ALL | {"j"}


def test_length():
    assert len(generate_password()) == 28


def test_pos1_uppercase():
    for _ in range(200):
        pw = generate_password()
        assert pw[0].isupper(), f"pos1 not uppercase: {pw}"


def test_pos2_lowercase_no_banned():
    for _ in range(200):
        pw = generate_password()
        c = pw[1]
        assert c.islower(), f"pos2 not lowercase: {pw}"
        assert c not in BANNED_POS2_LAST, f"pos2 banned '{c}': {pw}"


def test_last_lowercase_no_banned():
    for _ in range(200):
        pw = generate_password()
        c = pw[-1]
        assert c.islower(), f"last not lowercase: {pw}"
        assert c not in BANNED_POS2_LAST, f"last banned '{c}': {pw}"


def test_all_alphanumeric():
    for _ in range(200):
        pw = generate_password()
        assert pw.isalnum(), f"non-alphanumeric in: {pw}"


def test_no_globally_banned():
    for _ in range(500):
        pw = generate_password()
        for c in BANNED_ALL:
            assert c not in pw, f"banned '{c}' in: {pw}"


def test_uniqueness():
    assert len({generate_password() for _ in range(100)}) == 100