mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
Maurice
724c88c201
A mechanical prettier --write over server/src, server/tests, server/scripts and shared/src with the workspaces' .prettierrc; nothing but layout and import order changes, and every file keeps the same set of imports. shared is formatted throughout and its format baseline is empty. The server baseline keeps the 35 files that Prettier would grow past their lint:size limit (they need a split first, which is not a formatting change), and the generated entity files stay as their generator writes them.
89 lines
3.0 KiB
TypeScript
89 lines
3.0 KiB
TypeScript
import {
|
|
encrypt_api_key,
|
|
decrypt_api_key,
|
|
maybe_encrypt_api_key,
|
|
is_encrypted_api_key,
|
|
} from '../../../../../src/nest/common/crypto/apiKeyCrypto';
|
|
|
|
import { describe, it, expect } from 'vitest';
|
|
|
|
describe('apiKeyCrypto', () => {
|
|
const PLAINTEXT_KEY = 'my-secret-api-key-12345';
|
|
const ENC_PREFIX = 'enc:v1:';
|
|
|
|
// SEC-008 — Encrypted API keys not returned in plaintext
|
|
describe('encrypt_api_key', () => {
|
|
it('SEC-008: returns encrypted string with enc:v1: prefix', () => {
|
|
const encrypted = encrypt_api_key(PLAINTEXT_KEY);
|
|
expect(encrypted).toMatch(/^enc:v1:/);
|
|
});
|
|
|
|
it('different calls produce different ciphertext (random IV)', () => {
|
|
const enc1 = encrypt_api_key(PLAINTEXT_KEY);
|
|
const enc2 = encrypt_api_key(PLAINTEXT_KEY);
|
|
expect(enc1).not.toBe(enc2);
|
|
});
|
|
|
|
it('encrypted value does not contain the plaintext', () => {
|
|
const encrypted = encrypt_api_key(PLAINTEXT_KEY);
|
|
expect(encrypted).not.toContain(PLAINTEXT_KEY);
|
|
});
|
|
});
|
|
|
|
describe('decrypt_api_key', () => {
|
|
it('SEC-008: decrypts an encrypted key back to original', () => {
|
|
const encrypted = encrypt_api_key(PLAINTEXT_KEY);
|
|
const decrypted = decrypt_api_key(encrypted);
|
|
expect(decrypted).toBe(PLAINTEXT_KEY);
|
|
});
|
|
|
|
it('returns null for null input', () => {
|
|
expect(decrypt_api_key(null)).toBeNull();
|
|
});
|
|
|
|
it('returns null for empty string', () => {
|
|
expect(decrypt_api_key('')).toBeNull();
|
|
});
|
|
|
|
it('returns plaintext as-is if not prefixed (legacy)', () => {
|
|
expect(decrypt_api_key('plain-legacy-key')).toBe('plain-legacy-key');
|
|
});
|
|
|
|
it('returns null for tampered ciphertext', () => {
|
|
const encrypted = encrypt_api_key(PLAINTEXT_KEY);
|
|
const tampered = encrypted.replace(ENC_PREFIX, ENC_PREFIX) + 'TAMPER';
|
|
expect(decrypt_api_key(tampered)).toBeNull();
|
|
});
|
|
});
|
|
|
|
describe('maybe_encrypt_api_key', () => {
|
|
it('encrypts a new plaintext value', () => {
|
|
const result = maybe_encrypt_api_key('my-key');
|
|
expect(result).toMatch(/^enc:v1:/);
|
|
});
|
|
|
|
it('returns null for empty/falsy values', () => {
|
|
expect(maybe_encrypt_api_key('')).toBeNull();
|
|
expect(maybe_encrypt_api_key(null)).toBeNull();
|
|
expect(maybe_encrypt_api_key(undefined)).toBeNull();
|
|
});
|
|
|
|
it('returns already-encrypted value as-is (no double-encryption)', () => {
|
|
const encrypted = encrypt_api_key(PLAINTEXT_KEY);
|
|
const result = maybe_encrypt_api_key(encrypted);
|
|
expect(result).toBe(encrypted);
|
|
});
|
|
});
|
|
|
|
describe('is_encrypted_api_key', () => {
|
|
it('is true exactly for enc:v1: envelopes', () => {
|
|
expect(is_encrypted_api_key(encrypt_api_key('s'))).toBe(true);
|
|
expect(is_encrypted_api_key('enc:v1:AAAA')).toBe(true);
|
|
expect(is_encrypted_api_key('plaintext')).toBe(false);
|
|
expect(is_encrypted_api_key('')).toBe(false);
|
|
expect(is_encrypted_api_key(null)).toBe(false);
|
|
expect(is_encrypted_api_key(42)).toBe(false);
|
|
});
|
|
});
|
|
});
|