55 lines
1.4 KiB
Go
55 lines
1.4 KiB
Go
|
package email
|
||
|
|
|
||
|
|
import "testing"
|
||
|
|
|
||
|
|
func TestEncryptDecryptRoundTrip(t *testing.T) {
|
||
|
|
t.Setenv("APP_ENV", "development")
|
||
|
|
key := DeriveKey("0123456789abcdef0123456789abcdef", "")
|
||
|
|
enc, err := EncryptSecret(key, "re_test_secret")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if enc == "" || enc == "re_test_secret" {
|
||
|
|
t.Fatal("expected ciphertext")
|
||
|
|
}
|
||
|
|
plain, err := DecryptSecret(key, enc)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if plain != "re_test_secret" {
|
||
|
|
t.Fatalf("got %q", plain)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestDeriveKeyHex(t *testing.T) {
|
||
|
|
t.Setenv("APP_ENV", "development")
|
||
|
|
hexKey := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
key := DeriveKey(hexKey, "fallback")
|
||
|
|
if len(key) != 32 {
|
||
|
|
t.Fatalf("len=%d", len(key))
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestDecryptLegacyPlaintextRejectedInProduction(t *testing.T) {
|
||
|
|
t.Setenv("APP_ENV", "production")
|
||
|
|
key := DeriveKey("x", "y")
|
||
|
|
if _, err := DecryptSecret(key, "legacy-plain"); err == nil {
|
||
|
|
t.Fatal("expected plaintext decrypt rejected in production")
|
||
|
|
}
|
||
|
|
t.Setenv("APP_ENV", "development")
|
||
|
|
plain, err := DecryptSecret(key, "legacy-plain")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if plain != "legacy-plain" {
|
||
|
|
t.Fatalf("got %q", plain)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestDeriveKeyRejectsFallbackInProduction(t *testing.T) {
|
||
|
|
t.Setenv("APP_ENV", "production")
|
||
|
|
if key := DeriveKey("", "postgres://local"); key != nil {
|
||
|
|
t.Fatalf("expected nil key without explicit material in production, got len=%d", len(key))
|
||
|
|
}
|
||
|
|
}
|