Danny Kim
86 lines
2.1 KiB
TypeScript
86 lines
2.1 KiB
TypeScript
import { assertEquals, assertRejects } from "jsr:@std/assert@1";
|
|
import {
|
|
decryptCredential,
|
|
encryptCredential,
|
|
parseCredentials,
|
|
} from "./credentials.ts";
|
|
|
|
const MASTER_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8";
|
|
const OTHER_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
|
|
const NONCE = Uint8Array.from({ length: 12 }, (_, index) => index + 32);
|
|
const ENCRYPTED = "v1:ICEiIyQlJicoKSor:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA";
|
|
|
|
Deno.test("decrypts a known AES-256-GCM credential", async () => {
|
|
assertEquals(
|
|
await decryptCredential(ENCRYPTED, MASTER_KEY),
|
|
"secret-token",
|
|
);
|
|
});
|
|
|
|
Deno.test("encrypts a credential with a fresh supplied nonce", async () => {
|
|
assertEquals(
|
|
await encryptCredential("secret-token", MASTER_KEY, NONCE),
|
|
ENCRYPTED,
|
|
);
|
|
});
|
|
|
|
Deno.test("rejects a credential encrypted by another master key", async () => {
|
|
await assertRejects(() => decryptCredential(ENCRYPTED, OTHER_KEY));
|
|
});
|
|
|
|
Deno.test("rejects a credential with a nonstandard nonce", async () => {
|
|
await assertRejects(
|
|
() =>
|
|
decryptCredential(
|
|
"v1:AA:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA",
|
|
MASTER_KEY,
|
|
),
|
|
Error,
|
|
"nonce must be 12 bytes",
|
|
);
|
|
});
|
|
|
|
Deno.test("decrypts the central reviewer token and ordered profiles", async () => {
|
|
assertEquals(
|
|
await parseCredentials(
|
|
`
|
|
reviewer-token: ${ENCRYPTED}
|
|
profiles:
|
|
- type: claude
|
|
token: ${ENCRYPTED}
|
|
- type: codex
|
|
model: gpt-custom
|
|
`,
|
|
MASTER_KEY,
|
|
),
|
|
{
|
|
reviewerToken: "secret-token",
|
|
profiles: [
|
|
{
|
|
type: "claude",
|
|
model: "claude-sonnet-5",
|
|
token: "secret-token",
|
|
},
|
|
{ type: "codex", model: "gpt-custom" },
|
|
],
|
|
},
|
|
);
|
|
});
|
|
|
|
Deno.test("rejects malformed central credentials", async () => {
|
|
await assertRejects(
|
|
() => parseCredentials("profiles: []", MASTER_KEY),
|
|
Error,
|
|
"reviewer-token",
|
|
);
|
|
await assertRejects(
|
|
() =>
|
|
parseCredentials(
|
|
`reviewer-token: ${ENCRYPTED}\nprofiles:\n - type: claude`,
|
|
MASTER_KEY,
|
|
),
|
|
Error,
|
|
"profiles[0].token",
|
|
);
|
|
});
|