28 lines
1.1 KiB
TypeScript
28 lines
1.1 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { createSecretBox } from "../src/crypto";
|
|
|
|
test("round trips and uses a fresh IV each time", async () => {
|
|
const box = createSecretBox("s3cret");
|
|
const a = await box.encrypt("sk-ant-123");
|
|
const b = await box.encrypt("sk-ant-123");
|
|
expect(a).not.toBe(b);
|
|
expect(a).not.toContain("sk-ant-123");
|
|
expect(a.startsWith("v1.")).toBe(true);
|
|
expect(await box.decrypt(a)).toBe("sk-ant-123");
|
|
expect(await box.decrypt(b)).toBe("sk-ant-123");
|
|
});
|
|
|
|
test("another secret cannot decrypt", async () => {
|
|
const token = await createSecretBox("one").encrypt("key");
|
|
await expect(createSecretBox("two").decrypt(token)).rejects.toThrow();
|
|
});
|
|
|
|
test("a tampered token is rejected", async () => {
|
|
const token = await createSecretBox("one").encrypt("key");
|
|
const parts = token.split(".");
|
|
const ct = Buffer.from(parts[2]!, "base64");
|
|
ct[0] = ct[0]! ^ 1;
|
|
await expect(createSecretBox("one").decrypt(`${parts[0]}.${parts[1]}.${ct.toString("base64")}`)).rejects.toThrow();
|
|
await expect(createSecretBox("one").decrypt("garbage")).rejects.toThrow();
|
|
});
|