64 lines
1.9 KiB
Go
64 lines
1.9 KiB
Go
package crypto
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
corecrypto "git.ilapage.cn/OPC/chorus/internal/core/crypto"
|
|
)
|
|
|
|
func TestKeyRingRoundTripAndRotation(t *testing.T) {
|
|
oldKey := []byte("0123456789abcdef0123456789abcdef")
|
|
newKey := []byte("abcdef0123456789abcdef0123456789")
|
|
oldRing, err := NewKeyRing("old", map[string][]byte{"old": oldKey})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
oldEnvelope, err := oldRing.Encrypt(context.Background(), []byte("synthetic-api-key"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
rotated, err := NewKeyRing("new", map[string][]byte{"old": oldKey, "new": newKey})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
plaintext, err := rotated.Decrypt(context.Background(), oldEnvelope)
|
|
if err != nil || string(plaintext) != "synthetic-api-key" {
|
|
t.Fatalf("decrypt old envelope = %q, %v", plaintext, err)
|
|
}
|
|
newEnvelope, err := rotated.Encrypt(context.Background(), []byte("new-synthetic-key"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if newEnvelope.KeyID != "new" || newEnvelope.Version != 1 {
|
|
t.Fatalf("unexpected new envelope metadata: %#v", newEnvelope)
|
|
}
|
|
}
|
|
|
|
func TestKeyRingRejectsTamperAndUnknownKeyWithoutPlaintext(t *testing.T) {
|
|
ring, err := NewKeyRing("current", map[string][]byte{"current": []byte("0123456789abcdef0123456789abcdef")})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
secret := "do-not-leak-this-value"
|
|
envelope, err := ring.Encrypt(context.Background(), []byte(secret))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
envelope.Ciphertext[0] ^= 0xff
|
|
_, err = ring.Decrypt(context.Background(), envelope)
|
|
if !errors.Is(err, ErrInvalidEnvelope) || strings.Contains(err.Error(), secret) {
|
|
t.Fatalf("tamper error = %v", err)
|
|
}
|
|
|
|
_, err = ring.Decrypt(context.Background(), corecrypto.Envelope{
|
|
Version: 1, KeyID: "retired", Nonce: make([]byte, 12), Ciphertext: make([]byte, 16),
|
|
})
|
|
if !errors.Is(err, ErrUnknownKey) {
|
|
t.Fatalf("unknown key error = %v", err)
|
|
}
|
|
}
|