← back to Govarbitrage

src/lib/crypto.test.ts

27 lines

import { describe, expect, it, beforeAll } from "vitest";
import { encryptSecret, decryptSecret } from "./crypto";

beforeAll(() => {
  process.env.ENCRYPTION_KEY = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
});

describe("crypto (AES-256-GCM secret storage)", () => {
  it("round-trips a secret", () => {
    const enc = encryptSecret("sk-super-secret-token");
    expect(enc.ciphertext).not.toContain("super-secret");
    expect(decryptSecret(enc)).toBe("sk-super-secret-token");
  });

  it("produces a fresh IV each time (non-deterministic ciphertext)", () => {
    const a = encryptSecret("same");
    const b = encryptSecret("same");
    expect(a.iv).not.toBe(b.iv);
    expect(a.ciphertext).not.toBe(b.ciphertext);
  });

  it("rejects a tampered auth tag", () => {
    const enc = encryptSecret("payload");
    expect(() => decryptSecret({ ...enc, authTag: Buffer.from("00".repeat(16), "hex").toString("base64") })).toThrow();
  });
});