feat: harden prepaid billing and commercial operations

1 files changed, 17 insertions, 11 deletions

diff --git a/internal/security/credentials_test.go b/internal/security/credentials_test.go
index 07fa59e..570ec50 100644
--- a/internal/security/credentials_test.go
+++ b/internal/security/credentials_test.go
@@ -2,29 +2,35 @@ package security
 
 import (
 	"encoding/base64"
-	"strings"
 	"testing"
 )
 
-func TestCredentialCipherRoundTrip(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("k", 32)))
-	cipher, err := NewCredentialCipher(key)
+func TestCredentialKeyringDecryptsPreviousAndReencryptsWithPrimary(t *testing.T) {
+	primary := base64.StdEncoding.EncodeToString([]byte("01234567890123456789012345678901"))
+	previous := base64.StdEncoding.EncodeToString([]byte("abcdefghijklmnopqrstuvwxyzabcdef"))
+	oldCipher, err := NewCredentialCipher(previous)
 	if err != nil {
 		t.Fatal(err)
 	}
-	ciphertext, err := cipher.Encrypt("upstream-secret")
+	legacy, err := oldCipher.Encrypt("provider-secret")
 	if err != nil {
 		t.Fatal(err)
 	}
-	plaintext, err := cipher.Decrypt(ciphertext)
+	keyring, err := NewCredentialKeyring(primary, []string{previous})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if plaintext != "upstream-secret" {
-		t.Fatalf("unexpected plaintext: %q", plaintext)
+	if got, err := keyring.Decrypt(legacy); err != nil || got != "provider-secret" {
+		t.Fatalf("decrypt previous key: got %q, err %v", got, err)
 	}
-	ciphertext[len(ciphertext)-1] ^= 1
-	if _, err := cipher.Decrypt(ciphertext); err == nil {
-		t.Fatal("expected authentication failure for modified ciphertext")
+	rotated, err := keyring.Encrypt("provider-secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(rotated[:4]) != "AGK1" {
+		t.Fatalf("expected versioned credential envelope, got %q", rotated[:4])
+	}
+	if got, err := keyring.Decrypt(rotated); err != nil || got != "provider-secret" {
+		t.Fatalf("decrypt primary key: got %q, err %v", got, err)
 	}
 }