1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
package security
import (
"encoding/base64"
"testing"
)
func TestCredentialKeyringDecryptsPreviousAndReencryptsWithPrimary(t *testing.T) {
primary := base64.StdEncoding.EncodeToString([]byte("01234567890123456789012345678901"))
previous := base64.StdEncoding.EncodeToString([]byte("abcdefghijklmnopqrstuvwxyzabcdef"))
oldCipher, err := NewCredentialCipher(previous)
if err != nil {
t.Fatal(err)
}
legacy, err := oldCipher.Encrypt("provider-secret")
if err != nil {
t.Fatal(err)
}
keyring, err := NewCredentialKeyring(primary, []string{previous})
if err != nil {
t.Fatal(err)
}
if got, err := keyring.Decrypt(legacy); err != nil || got != "provider-secret" {
t.Fatalf("decrypt previous key: got %q, err %v", got, err)
}
rotated, err := keyring.Encrypt("provider-secret")
if err != nil {
t.Fatal(err)
}
if string(rotated[:4]) != "AGK1" {
t.Fatalf("expected versioned credential envelope, got %q", rotated[:4])
}
if got, err := keyring.Decrypt(rotated); err != nil || got != "provider-secret" {
t.Fatalf("decrypt primary key: got %q, err %v", got, err)
}
}
|
