forked from kevin/meshtastic_mqtt_server
73 lines
1.7 KiB
Go
73 lines
1.7 KiB
Go
package secrets
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestRoundTrip(t *testing.T) {
|
|
SetSecretKey("test-secret-key")
|
|
t.Cleanup(func() { SetSecretKey("") })
|
|
|
|
enc := Encrypt("s3cret-value")
|
|
if enc == "s3cret-value" {
|
|
t.Fatal("value must be encrypted when key is set")
|
|
}
|
|
if !strings.HasPrefix(enc, "enc:v1:") {
|
|
t.Fatalf("unexpected prefix: %q", enc)
|
|
}
|
|
if got := Decrypt(enc); got != "s3cret-value" {
|
|
t.Fatalf("round trip failed: %q", got)
|
|
}
|
|
}
|
|
|
|
func TestPlaintextPassthroughWhenNoKey(t *testing.T) {
|
|
SetSecretKey("")
|
|
if Encrypt("plain") != "plain" {
|
|
t.Error("must pass through when no key")
|
|
}
|
|
if Decrypt("plain") != "plain" {
|
|
t.Error("must pass through when no key")
|
|
}
|
|
}
|
|
|
|
func TestLegacyPlaintextStillReadable(t *testing.T) {
|
|
SetSecretKey("k1")
|
|
t.Cleanup(func() { SetSecretKey("") })
|
|
// 旧数据无前缀,解密应原样返回。
|
|
if Decrypt("legacy-plaintext") != "legacy-plaintext" {
|
|
t.Error("legacy plaintext must be returned as-is")
|
|
}
|
|
}
|
|
|
|
func TestWrongKeyFailsClosed(t *testing.T) {
|
|
SetSecretKey("key-a")
|
|
enc := Encrypt("top-secret")
|
|
SetSecretKey("key-b")
|
|
if Decrypt(enc) != "" {
|
|
t.Error("decrypt with wrong key must return empty (fail closed)")
|
|
}
|
|
SetSecretKey("key-a")
|
|
if Decrypt(enc) != "top-secret" {
|
|
t.Error("decrypt with correct key must succeed")
|
|
}
|
|
}
|
|
|
|
func TestEmptyValue(t *testing.T) {
|
|
SetSecretKey("k")
|
|
t.Cleanup(func() { SetSecretKey("") })
|
|
if Encrypt("") != "" {
|
|
t.Error("empty value stays empty")
|
|
}
|
|
}
|
|
|
|
func TestUniqueCiphertexts(t *testing.T) {
|
|
SetSecretKey("k")
|
|
t.Cleanup(func() { SetSecretKey("") })
|
|
a := Encrypt("same")
|
|
b := Encrypt("same")
|
|
if a == b {
|
|
t.Error("random nonce should produce different ciphertexts")
|
|
}
|
|
}
|