Danny Kim
69 lines
2.2 KiB
TypeScript
69 lines
2.2 KiB
TypeScript
import { expect, test } from "vite-plus/test";
|
|
import { decryptCredential, encryptCredential, parseCredentials } from "./credentials.ts";
|
|
|
|
const MASTER_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8";
|
|
const OTHER_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
|
|
const NONCE = Uint8Array.from({ length: 12 }, (_, index) => index + 32);
|
|
const ENCRYPTED = "v1:ICEiIyQlJicoKSor:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA";
|
|
|
|
test("decrypts a known AES-256-GCM credential", async () => {
|
|
expect(await decryptCredential(ENCRYPTED, MASTER_KEY)).toBe("secret-token");
|
|
});
|
|
|
|
test("encrypts a credential with a fresh supplied nonce", async () => {
|
|
expect(await encryptCredential("secret-token", MASTER_KEY, NONCE)).toStrictEqual(ENCRYPTED);
|
|
});
|
|
|
|
test("rejects a credential encrypted by another master key", async () => {
|
|
await expect(() => decryptCredential(ENCRYPTED, OTHER_KEY)).rejects.toThrow();
|
|
});
|
|
|
|
test("rejects a credential with a nonstandard nonce", async () => {
|
|
await expect(() =>
|
|
decryptCredential("v1:AA:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA", MASTER_KEY),
|
|
).rejects.toThrow("nonce must be 12 bytes");
|
|
});
|
|
|
|
test("decrypts the central reviewer token and ordered profiles", async () => {
|
|
expect(
|
|
await parseCredentials(
|
|
JSON.stringify({
|
|
"reviewer-token": ENCRYPTED,
|
|
profiles: [
|
|
{ type: "codex", model: "gpt-custom" },
|
|
{ type: "claude", token: ENCRYPTED },
|
|
{ type: "opencode", token: ENCRYPTED },
|
|
],
|
|
}),
|
|
MASTER_KEY,
|
|
),
|
|
).toStrictEqual({
|
|
reviewerToken: "secret-token",
|
|
profiles: [
|
|
{ type: "codex", model: "gpt-custom" },
|
|
{
|
|
type: "claude",
|
|
model: "claude-sonnet-5",
|
|
token: "secret-token",
|
|
},
|
|
{
|
|
type: "opencode",
|
|
model: "openrouter/qwen/qwen3.8-27b",
|
|
token: "secret-token",
|
|
},
|
|
],
|
|
});
|
|
});
|
|
|
|
test("rejects malformed central credentials", async () => {
|
|
await expect(() => parseCredentials('{"profiles": []}', MASTER_KEY)).rejects.toThrow(
|
|
"reviewer-token",
|
|
);
|
|
await expect(() =>
|
|
parseCredentials(
|
|
JSON.stringify({ "reviewer-token": ENCRYPTED, profiles: [{ type: "claude" }] }),
|
|
MASTER_KEY,
|
|
),
|
|
).rejects.toThrow("profiles[0].token");
|
|
});
|