Danny Kim
71 lines
2.1 KiB
TypeScript
71 lines
2.1 KiB
TypeScript
import { assertEquals, assertRejects } from "jsr:@std/assert@1";
|
|
import { decryptCredential, encryptCredential, parseCredentials } from "./credentials.ts";
|
|
|
|
const MASTER_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8";
|
|
const OTHER_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
|
|
const NONCE = Uint8Array.from({ length: 12 }, (_, index) => index + 32);
|
|
const ENCRYPTED = "v1:ICEiIyQlJicoKSor:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA";
|
|
|
|
Deno.test("decrypts a known AES-256-GCM credential", async () => {
|
|
assertEquals(await decryptCredential(ENCRYPTED, MASTER_KEY), "secret-token");
|
|
});
|
|
|
|
Deno.test("encrypts a credential with a fresh supplied nonce", async () => {
|
|
assertEquals(await encryptCredential("secret-token", MASTER_KEY, NONCE), ENCRYPTED);
|
|
});
|
|
|
|
Deno.test("rejects a credential encrypted by another master key", async () => {
|
|
await assertRejects(() => decryptCredential(ENCRYPTED, OTHER_KEY));
|
|
});
|
|
|
|
Deno.test("rejects a credential with a nonstandard nonce", async () => {
|
|
await assertRejects(
|
|
() => decryptCredential("v1:AA:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA", MASTER_KEY),
|
|
Error,
|
|
"nonce must be 12 bytes",
|
|
);
|
|
});
|
|
|
|
Deno.test("decrypts the central reviewer token and ordered profiles", async () => {
|
|
assertEquals(
|
|
await parseCredentials(
|
|
`
|
|
reviewer-token: ${ENCRYPTED}
|
|
profiles:
|
|
- type: codex
|
|
model: gpt-custom
|
|
- type: claude
|
|
token: ${ENCRYPTED}
|
|
- type: opencode
|
|
token: ${ENCRYPTED}
|
|
`,
|
|
MASTER_KEY,
|
|
),
|
|
{
|
|
reviewerToken: "secret-token",
|
|
profiles: [
|
|
{ type: "codex", model: "gpt-custom" },
|
|
{
|
|
type: "claude",
|
|
model: "claude-sonnet-5",
|
|
token: "secret-token",
|
|
},
|
|
{
|
|
type: "opencode",
|
|
model: "openrouter/qwen/qwen3.8-27b",
|
|
token: "secret-token",
|
|
},
|
|
],
|
|
},
|
|
);
|
|
});
|
|
|
|
Deno.test("rejects malformed central credentials", async () => {
|
|
await assertRejects(() => parseCredentials("profiles: []", MASTER_KEY), Error, "reviewer-token");
|
|
await assertRejects(
|
|
() => parseCredentials(`reviewer-token: ${ENCRYPTED}\nprofiles:\n - type: claude`, MASTER_KEY),
|
|
Error,
|
|
"profiles[0].token",
|
|
);
|
|
});
|