diff options
Diffstat (limited to 'internal/security/credentials_test.go')
| -rw-r--r-- | internal/security/credentials_test.go | 28 |
1 files changed, 17 insertions, 11 deletions
diff --git a/internal/security/credentials_test.go b/internal/security/credentials_test.go index 07fa59e..570ec50 100644 --- a/internal/security/credentials_test.go +++ b/internal/security/credentials_test.go @@ -2,29 +2,35 @@ package security import ( "encoding/base64" - "strings" "testing" ) -func TestCredentialCipherRoundTrip(t *testing.T) { - key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("k", 32))) - cipher, err := NewCredentialCipher(key) +func TestCredentialKeyringDecryptsPreviousAndReencryptsWithPrimary(t *testing.T) { + primary := base64.StdEncoding.EncodeToString([]byte("01234567890123456789012345678901")) + previous := base64.StdEncoding.EncodeToString([]byte("abcdefghijklmnopqrstuvwxyzabcdef")) + oldCipher, err := NewCredentialCipher(previous) if err != nil { t.Fatal(err) } - ciphertext, err := cipher.Encrypt("upstream-secret") + legacy, err := oldCipher.Encrypt("provider-secret") if err != nil { t.Fatal(err) } - plaintext, err := cipher.Decrypt(ciphertext) + keyring, err := NewCredentialKeyring(primary, []string{previous}) if err != nil { t.Fatal(err) } - if plaintext != "upstream-secret" { - t.Fatalf("unexpected plaintext: %q", plaintext) + if got, err := keyring.Decrypt(legacy); err != nil || got != "provider-secret" { + t.Fatalf("decrypt previous key: got %q, err %v", got, err) } - ciphertext[len(ciphertext)-1] ^= 1 - if _, err := cipher.Decrypt(ciphertext); err == nil { - t.Fatal("expected authentication failure for modified ciphertext") + rotated, err := keyring.Encrypt("provider-secret") + if err != nil { + t.Fatal(err) + } + if string(rotated[:4]) != "AGK1" { + t.Fatalf("expected versioned credential envelope, got %q", rotated[:4]) + } + if got, err := keyring.Decrypt(rotated); err != nil || got != "provider-secret" { + t.Fatalf("decrypt primary key: got %q, err %v", got, err) } } |