43 lines
1.4 KiB
Go
43 lines
1.4 KiB
Go
package service
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"browser.local/platform/repo"
|
|
)
|
|
|
|
func TestConfiguredSecretEnvelopeIsOpaqueAndRestartStable(t *testing.T) {
|
|
const key = "test-secret-envelope-key-at-least-32-characters"
|
|
const plain = "raw-component-secret"
|
|
svc := NewCoreService(repo.NewMemoryStore())
|
|
if err := svc.ConfigureSecretEnvelopeKey(key); err != nil {
|
|
t.Fatalf("configure envelope: %v", err)
|
|
}
|
|
encrypted, err := svc.encryptRuntimeKey(plain)
|
|
if err != nil {
|
|
t.Fatalf("seal secret: %v", err)
|
|
}
|
|
if strings.Contains(encrypted, plain) || !strings.HasPrefix(encrypted, "enc:v1:") {
|
|
t.Fatalf("unexpected envelope ciphertext %q", encrypted)
|
|
}
|
|
restarted := NewCoreService(repo.NewMemoryStore())
|
|
if err := restarted.ConfigureSecretEnvelopeKey(key); err != nil {
|
|
t.Fatalf("configure restarted envelope: %v", err)
|
|
}
|
|
decrypted, err := restarted.decryptRuntimeKey(encrypted)
|
|
if err != nil || decrypted != plain {
|
|
t.Fatalf("open restarted envelope: plain=%q err=%v", decrypted, err)
|
|
}
|
|
if _, err := NewCoreService(repo.NewMemoryStore()).decryptRuntimeKey(encrypted); err == nil {
|
|
t.Fatal("development fallback must not decrypt a custom-key envelope")
|
|
}
|
|
}
|
|
|
|
func TestSecretEnvelopeRejectsShortConfiguredKey(t *testing.T) {
|
|
svc := NewCoreService(repo.NewMemoryStore())
|
|
if err := svc.ConfigureSecretEnvelopeKey("too-short"); err == nil {
|
|
t.Fatal("expected short secret envelope key rejection")
|
|
}
|
|
}
|