Centralize encrypted bot profiles

2026-09-24 04:56:11 +09:00
parent ba9e0c0787
commit 80f3d922d1
22 changed files with 1973 additions and 526 deletions
@@ -0,0 +1,85 @@
+import { assertEquals, assertRejects } from "jsr:@std/assert@1";
+import {
+  decryptCredential,
+  encryptCredential,
+  parseCredentials,
+} from "./credentials.ts";
+
+const MASTER_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8";
+const OTHER_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
+const NONCE = Uint8Array.from({ length: 12 }, (_, index) => index + 32);
+const ENCRYPTED = "v1:ICEiIyQlJicoKSor:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA";
+
+Deno.test("decrypts a known AES-256-GCM credential", async () => {
+  assertEquals(
+    await decryptCredential(ENCRYPTED, MASTER_KEY),
+    "secret-token",
+  );
+});
+
+Deno.test("encrypts a credential with a fresh supplied nonce", async () => {
+  assertEquals(
+    await encryptCredential("secret-token", MASTER_KEY, NONCE),
+    ENCRYPTED,
+  );
+});
+
+Deno.test("rejects a credential encrypted by another master key", async () => {
+  await assertRejects(() => decryptCredential(ENCRYPTED, OTHER_KEY));
+});
+
+Deno.test("rejects a credential with a nonstandard nonce", async () => {
+  await assertRejects(
+    () =>
+      decryptCredential(
+        "v1:AA:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA",
+        MASTER_KEY,
+      ),
+    Error,
+    "nonce must be 12 bytes",
+  );
+});
+
+Deno.test("decrypts the central reviewer token and ordered profiles", async () => {
+  assertEquals(
+    await parseCredentials(
+      `
+reviewer-token: ${ENCRYPTED}
+profiles:
+  - type: claude
+    token: ${ENCRYPTED}
+  - type: codex
+    model: gpt-custom
+`,
+      MASTER_KEY,
+    ),
+    {
+      reviewerToken: "secret-token",
+      profiles: [
+        {
+          type: "claude",
+          model: "claude-sonnet-5",
+          token: "secret-token",
+        },
+        { type: "codex", model: "gpt-custom" },
+      ],
+    },
+  );
+});
+
+Deno.test("rejects malformed central credentials", async () => {
+  await assertRejects(
+    () => parseCredentials("profiles: []", MASTER_KEY),
+    Error,
+    "reviewer-token",
+  );
+  await assertRejects(
+    () =>
+      parseCredentials(
+        `reviewer-token: ${ENCRYPTED}\nprofiles:\n  - type: claude`,
+        MASTER_KEY,
+      ),
+    Error,
+    "profiles[0].token",
+  );
+});